Multiple USANet Creations Products Remote Command Execution Vulnerability

Bugtraq ID:	14179
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 07 2005 12:00AM
Updated:	Jul 07 2005 12:00AM
Credit:	Discovery is credited to <[email protected]>.
Vulnerable:	USANet Creations USANet Shopping Mall USANet Creations Standard Classified Ads USANet Creations MakeBid Reverse Auction USANet Creations MakeBid Auction Standard USANet Creations MakeBid Auction Deluxe 3.30 - Apache Apache 1.3.22 - Apache Apache 1.3.20 - Apache Apache 1.3.19 - Apache Apache 1.3.18 - Apache Apache 1.3.17 USANet Creations MakeBid Auction Deluxe USANet Creations Domain Name Auction
Not Vulnerable:

Multiple USANet Creations Products Remote Command Execution Vulnerability

Multiple USANet Creations Products are affected by a remote command execution vulnerability.

Reportedly, this issue arises when the user-specified values are passed to the 'dispallclosed.pl' script.

Due to this, an attacker can supply arbitrary commands and have them executed in the context of the server.

This issue may facilitate unauthorized remote access in the context of the Web server to the affected computer.

Multiple USANet Creations Products Remote Command Execution Vulnerability

An exploit is not required.

Multiple USANet Creations Products Remote Command Execution Vulnerability

Solution:
Reportedly, the vendor has released updates to address this issue. This cannot be confirmed at the moment. Please contact the vendor for more information.

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Multiple USANet Creations Products Remote Command Execution Vulnerability

References:

• Home Page (USANet Creations)