Bajie Webserver Remote Command Execution Vulnerability

It is possible to execute arbitrary commands on a host running Bajie Webserver.

A remote user can use Bajie's built-in upload feature to place malicious scripts on Bajie webservers. These uploaded scripts are placed in known destination directories and can be automatically executed. Unfortunately Bajie's CGI processor doesn't verify the CGI program exists before executing the script.

Once these files are uploaded, they can be then executed as CGI scripts on the server.


 

Privacy Statement
Copyright 2010, SecurityFocus