Exploit YaBB 9.11.2000 - 'search.pl' Arbitrary Command Execution

[Exploiter]

EDB-ID

20387

Проверка EDB

1. Пройдено

Автор

RPC

Тип уязвимости

REMOTE

Платформа

CGI

CVE

cve-2000-1176

Дата публикации

2000-11-07

source: https://www.securityfocus.com/bid/1921/info

YaBB (Yet Another Bulletin Board) is a popular perl-based bulletin board scripting package.

search. pl, one of several perl scripts which comprise YaBB, fails to properly validate user input which arguments a call to open(). 

A malicious user could supply a string containing '/../'-type sequences and shell commands. As a result of search.pl's failure to reject this type of input, it is possible to traverse the script's normal working directories, and to execute arbitrary commands on the host with the privelege level of YaBB. This can lead to an anonymous internet user gaining shell access to the host.


An attacker could easily create a malicious html form with a catsearch such as:
./../../../../../usr/bin/touch%20/tmp/foo|