HIS AUktion auktion.cgi Traversal Arbitrary Command Execution

The 'auktion.cgi' cgi is installed. This CGI has a well known security flaw that lets an attacker execute arbitrary commands with the privileges of the http daemon usually root or nobody. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc';...

CVE-2001-0212

CVE-2001-0212 describes a directory traversal in HIS Auktion 1.62 allowing remote read of arbitrary files via an encoded dot-dot in the menue parameter, with potential command execution through shell metacharacters. The Nessus plugin for HIS Auktion (auktion.cgi) flags a well-known flaw in the au...