Exploit PerlDesk Language Variable - Server-Side Script Execution

[Exploiter]

EDB-ID

24591

Проверка EDB

1. Пройдено

Автор

NIKYT0X ARGENTINA

Тип уязвимости

WEBAPPS

Платформа

CGI

CVE

cve-2004-1678

Дата публикации

2004-09-13

PerlDesk Language Variable - Server-Side Script Execution

source: https://www.securityfocus.com/bid/11160/info

It is reported that PerlDesk is susceptible to a server-side script execution vulnerability.

This vulnerability may be exploited to execute the contents of Perl scripts contained on the affected server filesystem. This will execute script code in the context of the affected CGI application, typically with the privileges of the web server process.

If a remote attacker does not have access to the affected server in a manner sufficient to place malicious a Perl script to exploit this vulnerability, they may still exploit it for information disclosure purposes. Error messages that will reportedly be displayed when PerlDesk attempts to include files requested by the attacker may contain potentially sensitive information. With sufficient knowledge of the affected system, an attacker may also cause other preexisting scripts to be executed that may also aid them in further attacks.

This vulnerability may aid the attacker in further application, or system attacks.

Http://www.example.com/cgi-bin/pdesk.cgi?lang=h4x0rs%20Rul3z
Http://www.example.com/cgi-bin/pdesk.cgi?lang=../../../../../../../proc/version%00