Anon Proxy Server Remote Shell Command Execution Vulnerabilities

Bugtraq ID:	26882
Class:	Input Validation Error
CVE:	CVE-2007-6459
Remote:	Yes
Local:	No
Published:	Dec 15 2007 12:00AM
Updated:	May 07 2015 05:34PM
Credit:	Michael Brooks is credited with discovering this issue.
Vulnerable:	Anon Proxy Server Anon Proxy Server 0.100
Not Vulnerable:

Anon Proxy Server Remote Shell Command Execution Vulnerabilities

Anony Proxy Server is prone to two vulnerabilities that allow attackers to execute arbitrary shell commands because the software fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary shell commands on an affected computer with the privileges of the application.

Anon Proxy Server Remote Shell Command Execution Vulnerabilities

Attackers may exploit this issue through a browser.

The following example was provided:

http://www.example.com/anon_proxy_server_0.100/diagdns.php?host=google.com%5C%27+%26%26+cat+%2Fetc%2Fpasswd+%23

Anon Proxy Server Remote Shell Command Execution Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Anon Proxy Server Remote Shell Command Execution Vulnerabilities

References:

• Anon Proxy Server Homepage (Anon Proxy Server)
  
• Anon Proxy Server - Remote Code Execution ([email protected])