The GBook CGI provides web sites with a CGI form for adding guest book notes and messages. This CGI suffers from a security hole that allows remote attackers to execute arbitrary commands though the _MAILTO parameter.
Using the _MAILTO parameter a remote attacker can execute any command they want. This is due to inadequate checks when 'popen' is called to execute the mail command. If ';' is used in the _MAILTO variable, you can execute arbitrary command with it.
Exploit:
This exploit executes "ps -ax" command and sends the result to attacker@example.com.
