SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Game)  >   probe.cgi Vendors:   [Multiple Authors/Vendors]
'probe.cgi' Input Validation Hole in 'olddat' Parameter Lets Remote Users Execute Arbitrary Commands
SecurityTracker Alert ID:  1014393
SecurityTracker URL:  http://securitytracker.com/id/1014393
CVE Reference:   CVE-2005-2178   (Links to External Site)
Updated:  Jun 24 2008
Original Entry Date:  Jul 5 2005
Impact:   Execution of arbitrary code via network, User access via network
Exploit Included:  Yes  

Description:   A vulnerability was reported in 'probe.cgi'. A remote user can execute arbitrary commands on the target system.

The script does not properly validate user-supplied input in the 'olddat' parameter. A remote user can supply a specially crafted parameter value to execute arbitrary commands on the target system. The commands will run with the privileges of the target web service.

A demonstration exploit URL is provided:

http://[target]/cgi-bin/probe.cgi?olddat=|id|

spher3 from BADROOT SECURITY GROUP reported this vulnerability.

Impact:   A remote user can execute arbitrary commands on the target system with the privileges of the target web service.
Solution:   No solution was available at the time of this entry.
Cause:   Input validation error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   None.


 Source Message Contents

Subject:  [badroot security] probe.cgi: Remote Command Execution


___________________________________________________________

BADROOT SECURITY GROUP
Security Advisory 2005 - #0x06
http://www.badroot.org
irc.us.azzurra.org ~ #badroot
___________________________________________________________

Authors .......  spher3 (spher3 at fatalimpulse dot net) Date 
..........  04-07-2005
Product .......  probe.cgi
Type ..........  Remote Command Execution

o Info:
================
That script is used to open file '.dat'.

o Vulnerable Code:
================
..
23  [...]
24  $old = $query->param('olddat');
25  [...]
..
..
34  [...]
35  open (VF, "$olddat");
36  [...]
..

(24) At this line, the cgi param 'olddat' is associated to one database.
    This variable isn't checked by anyone matching, so you can open
    all file that you want. (35) At this line the script open the file 
that you had chosen. With pipe `|`
    is possible to execute arbitrary code on the shell.

o Proof of concept:
================

http://the-vuln.site.org/cgi-bin/probe.cgi?olddat=|id|
uid=99(www) gid=99(www)

Original ADV: http://www.badroot.org/advisories/SA0x06

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC