FileSeek CGI Script Remote Command Execution Vulnerability

ID EDB-ID:22227
Type exploitdb
Reporter Thijs Bosschert
Modified 2002-04-16T00:00:00


FileSeek CGI Script Remote Command Execution Vulnerability. CVE-2002-0612. Webapps exploit for cgi platform


FileSeek is an example cgi-script from "The CGI/Perl Cookbook from John Wiley &
Sons". The script is written and maintained by Craig Patchett. It is mainly used to find and download files on a web server.

It has been reported that FileSeek.cgi and FileSeek2.cgi do not filter shell metacharacters from web requests. As a result, it is possible for a remote attacker to execute commands on the shell of a host running the vulnerable script. Commands will be executed with the privileges of the webserver process.

This impact of this vulnerability is that an attacker may gain local, interactive access to the host.;id|;id|&foot=|id||id|&foot=