Lucene search
K

webcgi98.txt

🗓️ 17 May 2001 00:00:00Reported by XbudType 
packetstorm
 packetstorm
🔗 packetstormsecurity.com👁 30 Views

Email to Acadsoft reveals webcgi98.exe exposes server path, posing security risks for universities.

Code
`The following e-mail was sent to Acadsoft support about a week ago and I  
have yet recieved a response so I thought it was time to make it public.  
As I mentioned in the email I felt it was important because various  
universities use this as a registration utility.   
  
>Hi,  
>I was playing around with your demo binary on your webpage and noticed  
>that an invalid request to your executable 'webcgi98.exe' displays the  
>absolute  
>path of the of your webserver directory and an ini file it's trying to  
>locate.  
>  
>I'm not sure if version 2.6 is correct, but here is the demo I was using.  
>http://www.acadsoft.com/cgi-win/webcgi98.exe? <press enter>  
>With no or *any* invalid arguemnts are used the following error is  
>dispalyed:  
>  
>Error  
>  
>The system was unable to process your request.  
>  
>Query String = >AAAKEY NOT FOUND<  
>Decoded String = >AAAKEY NOT FOUND<  
>Ini File Name = >C:\WebSite\cgi-temp\11485ws.ini<  
>  
>  
>This should have been properly QA'ed and needs to be fixed. Various  
>Universities use this as there WebRegistration software so I felt it was  
>important enough to bring up.  
>  
>cheers,  
>  
>  
>-----------------------------  
>[email protected]  
>[email protected]  
>"I only drink to make other people interesting."  
>-----------------------------  
  
  
`

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation