Kootenay Web Inc whois 1.0 - Remote Command Execution Vulnerability

2000-10-29T00:00:00
ID EDB-ID:20370
Type exploitdb
Reporter Mark Stratman
Modified 2000-10-29T00:00:00

Description

Kootenay Web Inc whois 1.0 Remote Command Execution Vulnerability. CVE-2000-0941. Remote exploit for cgi platform

                                        
                                            source: http://www.securityfocus.com/bid/1883/info

whois is a utility used to find general information and technical details about registered domain names. A vulnerability exists in Kootenay Web Inc's Whois (release v.1.9), a web interface to whois running on a linux server. 

Due to a failure to properly check user-supplied input to a form variable for shell metacharacters, a malicious remote user can trick the script into executing arbitrary code on the host system. At that point an attacker can gain local shell access to the system with the privileges of the webserver. Further compromise (eg, root) may follow.

Unsafe code:
$site = $query->param('whois');
....
$app = `whois $site`;
print "$app .......

Proof of concept:
Type ";id" (without the quotes) into the input box.