adstreamer.txt

`  
[[ RFP's note:  
  
I have verified this vulnerability in the current version on the site  
indicated below. The most severe problem would be that the  
"$input{'cat'}.dat" open in banner.cgi would allow an attacker to run  
commands (the 'cat' parameter is not double-checked/filtered in any way).  
The other CGIs are less severe because they (should) be kept out of access  
by the public, since they let you admin the whole banner system without  
any native auth. ]]  
  
----------------------------------------------------------------------------  
  
PRODUCT  
*******  
  
AdStreamer  
http://www.sha-la-la.com/adstreamer/  
  
DESCRIPTION  
***********  
  
This software have many an open call that can exploited with Perl tricks  
like ../, %00, |, etc.  
  
bash-2.05$ egrep 'open|system|exec|eval' *.cgi  
addbanner.cgi:# This script is apart of the Banner Manager system.  
It will add banners  
addbanner.cgi:open(HEADERFILE, "banner/$thebannercat.dat") || die("error  
opening the file $thebannercat.dat");  
addbanner.cgi:open(HEADERFILE, ">banner/$thebannercat.dat") || die("error  
opening the file $thebannercat.dat");  
addbanner.cgi: open(HEADERFILE, ">>banner/$logfile") || die("error opening  
the file $logfile");  
addbanner.cgi: open(HEADERFILE, ">banner/$logfile") || die("error opening  
the file $logfile");  
banner.cgi:# This script is apart of the Banner Manager system.  
It adds banner  
banner.cgi:open(HEADERFILE, "$input{'cat'}.dat") || die("error opening the  
file $input{'cat'}.dat");  
banner.cgi:open(HEADERFILE, ">$input{'cat'}.dat") || die("error opening the  
file $input{'cat'}.dat");  
banner.cgi: open(HEADERFILE, ">>$logfile") || die("error opening the  
file $logfile");  
banner.cgi: open(HEADERFILE, ">$logfile") || die("error opening the file  
$logfile");  
bannereditor.cgi:# This script is apart of the Banner Manager  
system. It preforms banner  
bannereditor.cgi:open(HEADERFILE, "titles.dat") || die("error opening the  
file titles.dat");  
bannereditor.cgi: open(HEADERFILE, "$input{'cat'}.dat") || die("error  
opening the file $input{'cat'}.dat");  
bannereditor.cgi: open(HEADERFILE, ">$input{'cat'}.dat") || die("error  
opening the file $input{'cat'}.dat");  
bannereditor.cgi: open(HEADERFILE, "$input{'cat'}.dat") || die("error  
opening the file $input{'cat'}.dat");  
bannereditor.cgi: open(HEADERFILE, "categories.dat") || die("error  
opening the file categories.dat");  
bannereditor.cgi: open(HEADERFILE, ">categories.dat") || die("error  
opening the file categories.dat");  
bannereditor.cgi: open(HEADERFILE, ">ref.dat") || die("error opening  
the file ref.dat");  
bannereditor.cgi: open(HEADERFILE, ">titles.dat") || die("error  
opening the file titles.dat");  
bannereditor.cgi: open(HEADERFILE, "categories.dat") || die("error  
opening the file categories.dat");  
bannereditor.cgi: open(HEADERFILE, "$cat.dat") || die("error  
opening the file $cat.dat");  
bannereditor.cgi: open(HEADERFILE, ">$cat.dat") || die("error  
opening the file $cat.dat");  
bannereditor.cgi: open(HEADERFILE, "categories.dat") || die("error  
opening the file categories.dat");  
bannereditor.cgi: open(HEADERFILE, "$cat.dat") || die("error  
opening the file $cat.dat");  
bannereditor.cgi: open(HEADERFILE, ">>ref.dat") || die("error opening  
the file ref.dat");  
bannereditor.cgi: open(HEADERFILE, ">>titles.dat") || die("error  
opening the file titles.dat");  
bannereditor.cgi: open(HEADERFILE, "categories.dat") || die("error  
opening the file categories.dat");  
bannereditor.cgi: open(HEADERFILE, "categories.dat") || die("error  
opening the file categories.dat");  
bannereditor.cgi: open(HEADERFILE, "$cat.dat") ||  
die("error opening the file $cat.dat");  
bannereditor.cgi: open(HEADERFILE, ">>$cat.dat") ||  
die("error opening the file $cat.dat");  
bannereditor.cgi: open(HEADERFILE, ">$input{'newcat'}.dat") ||  
die("error opening the file $input{'newcat'}.dat");  
bannereditor.cgi: open(HEADERFILE, ">>categories.dat") || die("error  
opening the file categories.dat");  
bannereditor.cgi: open(HEADERFILE, "categories.dat") || die("error  
opening the file categories.dat");  
bannereditor.cgi: open(HEADERFILE, "$cat.dat") || die("error  
opening the file $cat.dat");  
bannereditor.cgi: open(HEADERFILE, "categories.dat") || die("error  
opening the file categories.dat");  
bannereditor.cgi: open(HEADERFILE, "ref.dat") || die("error opening  
the file ref.dat");  
jump.cgi:# This script is apart of the Banner Manager system.  
It recieves every  
jump.cgi:open(HEADERFILE, "ref.dat") || die("error opening the file  
ref.dat");  
jump.cgi: open(HEADERFILE, ">>$logfile") || die("error opening  
the file $logfile");  
jump.cgi: open(HEADERFILE, ">$logfile") || die("error opening  
the file $logfile");  
report2.cgi:# This script is apart of the Banner Manager system.  
It generates reports  
report2.cgi:open(HEADERFILE, "titles.dat") || die("error opening the file  
titles.dat");  
report2.cgi:opendir(LOGDIR, ".") || die("error");  
report2.cgi: open(HEADERFILE, "$file.log") || die("error opening the file  
$file.log");  
report2.cgi:opendir(LOGDIR, ".") || die("error");  
report2.cgi: open(HEADERFILE, "$file.log") || die("error opening the file  
$file.log");  
report2.cgi:opendir(LOGDIR, ".") || die("error");  
report2.cgi: open(HEADERFILE, "$file.log") || die("error opening the file  
$file.log");  
report2.cgi:open(HEADERFILE, "categories.dat") || die("error opening the  
file categories.dat");  
report2.cgi:opendir(LOGDIR, ".") || die("error");  
report2.cgi:open(HEADERFILE, "categories.dat") || die("error opening the  
file categories.dat");  
report2.cgi:open(HEADERFILE, "$input{'log'}") || die("error opening the file  
$input{'log'}");  
report2.cgi:open(HEADERFILE, "$input{'log'}") || die("error opening the file  
$input{'log'}");  
report2.cgi:open(HEADERFILE, "$input{'log'}") || die("error opening the file  
$input{'log'}");  
report2.cgi:opendir(LOGDIR, ".") || die("error");  
report2.cgi:open(HEADERFILE, "categories.dat") || die("error opening the  
file categories.dat");  
  
VENDOR NOTIFICATION  
*******************  
  
Vendor is informed now with public. Not to worry, since malicious people  
don't read Bugtraq.  
  
  
GOBBLES LABS  
[email protected]  
http://www.bugtraq.org/  
  
`