Monster Top List Remote Command Execution Vulnerability

Bugtraq ID:	23074
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 21 2007 12:00AM
Updated:	Mar 21 2007 01:43PM
Credit:	fluffy_bunny is attributed with the discovery of this vulnerability.
Vulnerable:	Monster Top List Monster Top List 1.4.2 Monster Top List Monster Top List 1.4
Not Vulnerable:

Monster Top List Remote Command Execution Vulnerability

Monster Top List is prone to a remote command-execution vulnerability because the application fails to properly sanitize user-supplied input.

Exploiting this issue allows attackers to execute arbitrary commands in the context of the server.

This issue affects versions 1.4.2 and prior.

Monster Top List Remote Command Execution Vulnerability

Attackers can exploit this issue via a browser.

The following proof-of-concept demonstrates this issue.

• /data/vulnerabilities/exploits/MTL_remotecommand.pl

Monster Top List Remote Command Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

Monster Top List Remote Command Execution Vulnerability

References:

• Vendor Homepage (Moster Top List)