Leif M. Wright Web Blog 1.1 - Remote Command Execution

Author: ActualMInd
type: webapps
platform: cgi
port: 
date_added: 2004-01-31 
date_updated: 2012-12-24 
verified: 1 
codes: CVE-2004-2347;OSVDB-3793 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/9539/info

Web Blog has been reported to be prone to a vulnerability that may permit remote attackers to execute arbitrary commands in the context of the hosting web server. This is due to insufficient sanitization of shell metacharacters from variables which will be used as an argument to a function that invokes the shell directly.

http://www.example.com/directory/blog.cgi?submit=ViewFile&month=[month]&year=[year]&file=|command|