https://www.exploit-db.com/exploits/20660
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200105-002

kicqIRC客户端1.0.0版本以及可能之后的版本存在漏洞。远程攻击者可以借助URL中的shell元字符执行任意命令。

source: http://www.securityfocus.com/bid/2443/info

KICQ is an ICQ-compatible interactive messaging client for Unix. Versions of KICQ are vulnerable to remote execution of arbitrary commands embedded in URLs.

A maliciously-composed URL containing shell metacharacters and shell commands can be sent in an instant message by an attacker.

When the KICQ user clicks this link, the hostile code contained in the URL will execute with the privilege level of the user running KICQ. 

* Attacker composes malicious URL, ie:

http://www.attack.com/index.html'&xterm&'truehttp://www.attack.com </external/http://www.attack.com/index.html'&xterm&'truehttp://www.attack.com>..............................................................

('.' characters = spaces)

* To the target user, the above URL appears to be:

"http://www.attack.com/" </external/http://www.attack.com/>

* When the target user opens the URL, the shell commands contained within it (ie 'xterm') will be executed, potentially without warning to the user.

来源:BUGTRAQ
名称:20010303Re:Securityholeinkicq
链接:http://archives.neohapsis.com/archives/bugtraq/2001-02/0536.html
来源:BUGTRAQ
名称:20010214Securityholeinkicq
链接:http://archives.neohapsis.com/archives/bugtraq/2001-02/0276.html
来源:XF
名称:kicq-execute-commands(6112)
链接:http://xforce.iss.net/xforce/xfdb/6112