Bajie Webserver 0.78/0.90 Remote Command Execution Vulnerability

ID SSV:74507
Type seebug
Reporter Root
Modified 2014-07-01T00:00:00


No description provided by source.


It is possible to execute arbitrary commands on a host running Bajie Webserver.

A remote user can use Bajie's built-in upload feature to place malicious scripts on Bajie webservers. These uploaded scripts are placed in known destination directories and can be automatically executed. Unfortunately Bajie's CGI processor doesn't verify the CGI program exists before executing the script.

Once these files are uploaded, they can be then executed as CGI scripts on the server. 

Upload the malicious script via:


Execute it via:

http://target/cgi/bin//...//upload/[file name]