{"cve": [{"lastseen": "2021-02-02T05:19:03", "description": "Kootenay Web KW Whois 1.0 CGI program allows remote attackers to execute arbitrary commands via shell metacharacters in the \"whois\" parameter.", "edition": 4, "cvss3": {}, "published": "2000-12-19T05:00:00", "title": "CVE-2000-0941", "type": "cve", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": true, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2000-0941"], "modified": "2017-10-10T01:29:00", "cpe": ["cpe:/a:kootenay_web_inc:kootenay_web_inc_whois:1.0"], "id": "CVE-2000-0941", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2000-0941", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "cpe23": ["cpe:2.3:a:kootenay_web_inc:kootenay_web_inc_whois:1.0:*:*:*:*:*:*:*"]}], "exploitdb": [{"lastseen": "2016-02-02T14:05:54", "description": "Kootenay Web Inc whois 1.0 Remote Command Execution Vulnerability. CVE-2000-0941. Remote exploit for cgi platform", "published": "2000-10-29T00:00:00", "type": "exploitdb", "title": "Kootenay Web Inc whois 1.0 - Remote Command Execution Vulnerability", "bulletinFamily": "exploit", "cvelist": ["CVE-2000-0941"], "modified": "2000-10-29T00:00:00", "id": "EDB-ID:20370", "href": "https://www.exploit-db.com/exploits/20370/", "sourceData": "source: http://www.securityfocus.com/bid/1883/info\r\n\r\nwhois is a utility used to find general information and technical details about registered domain names. A vulnerability exists in Kootenay Web Inc's Whois (release v.1.9), a web interface to whois running on a linux server. \r\n\r\nDue to a failure to properly check user-supplied input to a form variable for shell metacharacters, a malicious remote user can trick the script into executing arbitrary code on the host system. At that point an attacker can gain local shell access to the system with the privileges of the webserver. Further compromise (eg, root) may follow.\r\n\r\nUnsafe code:\r\n$site = $query->param('whois');\r\n....\r\n$app = `whois $site`;\r\nprint \"$app .......\r\n\r\nProof of concept:\r\nType \";id\" (without the quotes) into the input box.", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "sourceHref": "https://www.exploit-db.com/download/20370/"}], "nessus": [{"lastseen": "2021-01-20T11:36:52", "description": "The version of the KW whois CGI script installed on the remote web\nserver fails to filter input to the 'whois' parameter of shell\nmetacharacters. An unauthenticated, remote attacker can leverage this\nissue to execute arbitrary commands with the privileges of the http\ndaemon.", "edition": 26, "published": "2002-11-29T00:00:00", "title": "KW Whois CGI whois Parameter Arbitrary Command Execution", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2000-0941"], "modified": "2002-11-29T00:00:00", "cpe": [], "id": "KW_WHOIS.NASL", "href": "https://www.tenable.com/plugins/nessus/10541", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif(description)\n{\n script_id(10541);\n script_version(\"1.29\");\n\n script_cve_id(\"CVE-2000-0941\");\n script_bugtraq_id(1883);\n\n script_name(english:\"KW Whois CGI whois Parameter Arbitrary Command Execution\");\n script_summary(english:\"Checks for the presence of /cgi-bin/whois.cgi\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote web server hosts a CGI script that allows execution of\narbitrary commands.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The version of the KW whois CGI script installed on the remote web\nserver fails to filter input to the 'whois' parameter of shell\nmetacharacters. An unauthenticated, remote attacker can leverage this\nissue to execute arbitrary commands with the privileges of the http\ndaemon.\"\n );\n script_set_attribute(\n attribute:\"see_also\", \n value:\"https://seclists.org/bugtraq/2000/Oct/426\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Unknown at this time.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:U/RC:ND\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(\n attribute:\"vuln_publication_date\", \n value:\"2000/10/29\"\n );\n script_set_attribute(\n attribute:\"plugin_publication_date\", \n value:\"2002/11/29\"\n );\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_end_attributes();\n \n script_category(ACT_ATTACK);\n \n script_copyright(english:\"This script is Copyright (C) 2000-2021 Tenable Network Security, Inc.\");\n script_family(english:\"CGI abuses\");\n\n script_dependencie(\"http_version.nasl\");\n script_exclude_keys(\"Settings/disable_cgi_scanning\");\n script_require_ports(\"Services/www\", 80);\n exit(0);\n}\n\n\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"http.inc\");\n\nhttp_check_remote_code (\n\t\t\tcheck_request:\"/whois.cgi?action=load&whois=%3Bid\",\n\t\t\tcheck_result:\"uid=[0-9]+.*gid=[0-9]+.*\",\n\t\t\tcommand:\"id\"\n\t\t\t);\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}]}
