Mailnews.cgi Username Remote Shell Commands Vulnerability
BID:2391
Info
Mailnews.cgi Username Remote Shell Commands Vulnerability
| Bugtraq ID: | 2391 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Feb 18 2001 12:00AM |
| Updated: | Feb 18 2001 12:00AM |
| Credit: | Reported to bugtraq by Kanedaaa Bohater <[email protected]> on February 18, 2001. |
| Vulnerable: |
Mailnews Mailnews.cgi 1.3 |
| Not Vulnerable: | |
Discussion
Mailnews.cgi Username Remote Shell Commands Vulnerability
Mailnews.cgi fails to check remote user-supplied input for shell metacharacters. A remote attacker can insert a new user to the mailnews' user file which includes malicious shell commands in the username field. Upon displaying this this data, the embedded commands will execute with the privileges of the webserver process.
Mailnews.cgi fails to check remote user-supplied input for shell metacharacters. A remote attacker can insert a new user to the mailnews' user file which includes malicious shell commands in the username field. Upon displaying this this data, the embedded commands will execute with the privileges of the webserver process.
Exploit / POC
Mailnews.cgi Username Remote Shell Commands Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]