evuln.MyQuiz.txt

`New eVuln Advisory:  
MyQuiz Arbitrary Command Execution Vulnerability  
http://evuln.com/vulns/57/summary.html  
  
--------------------Summary----------------  
  
Software: MyQuiz  
Sowtware's Web Site: http://www.corantodemo.net/  
Versions: 1.01  
Critical Level: Dangerous  
Type: Command Execution  
Class: Remote  
Status: Unpatched. Developer(s) contacted.  
Exploit: Available  
Solution: Not Available  
Discovered by: Aliaksandr Hartsuyeu (eVuln.com)  
eVuln ID: EV0057  
  
-----------------Description---------------  
Vulnerable Script: myquiz.pl  
  
Variable $ENV{'PATH_INFO'} isn't properly sanitized. This can be used to execute arbitrary commands.  
  
System access is possible.  
  
--------------Exploit----------------------  
Available at: http://evuln.com/vulns/57/exploit.html  
  
Url Example:  
  
http://host/cgi-bin/myquiz.pl/ask/;command|  
  
  
  
--------------Solution---------------------  
No Patch available.  
  
--------------Credit-----------------------  
Discovered by: Aliaksandr Hartsuyeu (eVuln.com)  
  
`