Active Classifieds Arbitrary Code Execution Vulnerability

Bugtraq ID:	2942
Class:	Origin Validation Error
CVE:	CVE-2001-1290
Remote:	Yes
Local:	No
Published:	Jun 28 2001 12:00AM
Updated:	Jul 11 2009 06:56AM
Credit:	Reported by Igor Dobrovitski <[email protected]> on June 28, 2001.
Vulnerable:	Active Web Suite Technologies Active Classifieds Free Edition 1.0
Not Vulnerable:

Active Classifieds Arbitrary Code Execution Vulnerability

Active Classifieds is a CGI package that provides an online classified advertisement listing and management system.

An origin validation error exists in the Free Edition of Active Classifieds that may allow remote users to perform some administrative commands without authentication. As a result, it may be possible to cause arbitrary commands to be executed on a host running the software.

It is currently unclear as to whether commercial versions of Active Classifieds are also vulnerable.

Active Classifieds Arbitrary Code Execution Vulnerability

Igor Dobrovitski <[email protected]> has made an exploit available:

• /data/vulnerabilities/exploits/active-classifieds.pl

Active Classifieds Arbitrary Code Execution Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Active Classifieds Arbitrary Code Execution Vulnerability

References:

• Active Web Suite Technologies Homepage (Active Web Suite Technologies)