[7198] in bugtraq
WWW Authorization Gateway
daemon@ATHENA.MIT.EDU (Albert Nubdy)
Thu Jul 9 16:01:11 1998
Date: Wed, 8 Jul 1998 20:08:49 -0400
Reply-To: Albert Nubdy <formatez@EDUREDES.EDU.DO>
From: Albert Nubdy <formatez@EDUREDES.EDU.DO>
To: BUGTRAQ@NETSPACE.ORG
-----BEGIN PGP SIGNED MESSAGE-----
Hello,
I have discovered a problem in the WWW Authorization Gateway 0.1
By Ray Chan From West's Perl Archive. This CGI Lets users grant or
deny access tosome pages. You can Execute any command you please with
it.
That is because of this little line: "$info = `grep $DATA{"user"}
$passurl`;".
To exploit You would just have to put:
"| any command you would like" as a Username and any password.
FormateZ
-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 5.5.3i for non-commercial use <http://www.pgpi.com>
iQA/AwUBNaQxceUnuPHnmgTPEQL1fACaAr/WMae2qu78PwrG9orZNc4jvCEAoO3R
FC/KpjgPjJrHSSyhVPSe6w87
=hyj4
-----END PGP SIGNATURE-----
