Webhints <= 1.03 Remote Command Execution Exploit (perl code) (3)

No description provided by source. !/usr/bin/perl -w emanuele@blackbox:$ perl M4DR007-hints.pl www.madroot.edu.ms Security Group WebHints Software hints.cgi Remote Command Execution Vulnerability Affected version: = all code by MadSheep 06.11.2005 hostname: localhost port: default: 80 80 path:...

Solaris 7.0/8 Sunsolve CD SSCD_SunCourier.pl CGI Script Arbitrary Command Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/4269/info The Sunsolve CD is part of the Solaris Media pack. It is included as a documentation resource, and is available for the Solaris Operating Environment. A CGI script included with the CD does not adequately saniti...

ultrascripts ultraboard 1.6 - Directory Traversal vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1164/info UltraBoard 1.6 and possibly all 1.x versions is vulnerable to a directory traversal attack that will allow any remote browser to download any file that the webserver has read access to. On Windows instalations,...

3R Soft MailStudio 2000 2.0 userreg.cgi Arbitrary Command Execution

No description provided by source. source: http://www.securityfocus.com/bid/1335/info MailStudio 2000 is vulnerable to multiple attacks. It is possible for a remote user to gain read access to all files located on the server via the usage of the /.. string passed to a CGI, thereby compromising th...

CGI-World Poll It 2.0 Internal Variable Override Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1431/info Poll It is a Perl CGI application used to create and maintain opinion polls on websites. The program relies on a number of internal variables. These variables can be overwritten by any remote user by specifying...

Hughes Technologies Mini SQL (mSQL) 2.0/2.0.10 Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/591/info Under certain versions of Mini SQL, the w3-msql CGI script allows users to view directories which are set for private access via .htaccess files. W3-mSQL converts any form data passed to a script into global Lite...

Microsoft IIS/PWS CGI Filename Double Decode Command Execution

No description provided by source. $Id: ms01026dbldecode.rb 11513 2011-01-08 00:25:44Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms o...

HP OpenView NNM getnnmdata.exe CGI Invalid Hostname Remote Code Execution

No description provided by source. Exploit Title: HP OpenView NNM getnnmdata.exe CGI Invalid Hostname Remote Code Execution Date: 2010.07.02 Author: S2 Crew Hungary Software Link: hp.com Version: 7.53 Tested on: Windows 2003 CVE: CVE-2010-1555 Code : !/usr/bin/python import struct import socket...

gitWeb 1.5.2 - Remote Command Execution

No description provided by source. Exploit Title: gitWeb remote command execution Date: 2009.06.19 Author: S2 Crew Hungary Software Link: - Version: GIT 1.5.2 Tested on: debian linux, GIT 1.5.2 CVE: CVE-2008-5516 - CVE-2008-5517 Code: The cgi script doesn't show the command output blind command...

Caldera OpenLinux 2.3 rpm_query CGI Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1036/info A vulnerability exists in the default installation of Caldera OpenLinux 2.3. A CGI is installed in /home/httpd/cgi-bin/ names rpmquery. Any user can run this CGI and obtain a listing of the packages, and version...

MS IIS 3.0/4.0/5.0 PWS Escaped Characters Decoding Command Execution (1)

No description provided by source. source: http://www.securityfocus.com/bid/2708/info Due to a flaw in the handling of CGI filename program requests, remote users can execute arbitrary commands on an IIS host. When IIS receives a CGI filename request, it automatically performs two actions before...

Excite for Web Servers 1.1 Administrative Password Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2665/info Excite for Web Servers 1.1 EWS is a search engine suite for web servers running under Windows NT and UNIX. By default the file containing the administrative password, architext.conf, is world readable and world...

Cogent DataHub HTTP Server Buffer Overflow

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3...

Apache 2.2 (Windows) Local Denial of Service

No description provided by source. !c:\perl\bin\ Exploit Title: Apache 2.2 local denail of service windows Date: 25/10/2010 Author: FB1H2S Software Link: http://httpd.apache.org/. Version: APACHE 2.2.16 Tested on: wINDOWS xP SERVICE PACK 3 CVE : Save the file as .pl in apache cgi-bin and Call...

AutomatedShops WebC 2.0/5.0 Symbolic Link Following Configuration File Weakness

No description provided by source. source: http://www.securityfocus.com/bid/7272/info It has been reported that WebC will execute in the directory of a symbolic link from which it is invoked. Because of this, it may be possible for a local user to load a configuration file that enabled dangerous...

Computer Software Manufaktur Alibaba 2.0 - Multiple CGI Vulnerabilties

No description provided by source. source: http://www.securityfocus.com/bid/770/info There are several CGI programs that ship with the Alibaba webserver. Many of these do not do proper input handling, and therefore will allow requests for access to files outside of normal or safe webserver...

NCSA 1.3/1.4.x/1.5,Apache httpd 0.8.11/0.8.14 ScriptAlias Source Retrieval Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2300/info NSCA httpd prior to and including 1.5 and Apache Web Server prior to 1.0 contain a bug in the ScriptAlias function that allows remote users to view the source of CGI programs on the web server, if a ScriptAlias...

Cart32 3.0 "expdate" Administrative Information Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1358/info By appending the string /expdate to a request for the cart32.exe executable, http: //target/cgi-bin/cart32.exe/expdate an attacker can access an error message followed by a debugging page containing the server...

CNC Technology BizDB 1.0 bizdb-search.cgi Remote Command Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1104/info BizDB is a web databse integration product using perl CGI scripts. One of the scripts, bizdb-search.cgi, passes a variable's contents to an unchecked open call and can therefore be made to execute commands at th...

HP OpenView NNM getnnmdata.exe CGI Invalid MaxAge Remote Code Execution

No description provided by source. Exploit Title: HP OpenView NNM getnnmdata.exe CGI Invalid MaxAge Remote Code Execution Date: 2010.07.02 Author: S2 Crew Hungary Software Link: hp.com Version: 7.53 Tested on: Windows 2003 CVE: CVE-2010-1553 Code : !/usr/bin/python import struct import socket...