CSLiveSupport Remote Command Execution Vulnerability
BID:4450
Info
CSLiveSupport Remote Command Execution Vulnerability
| Bugtraq ID: | 4450 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 08 2002 12:00AM |
| Updated: | Apr 08 2002 12:00AM |
| Credit: | This issue was publicized by Steve Gustin <[email protected]>. |
| Vulnerable: |
CGISCRIPT.NET csLiveSupport 1.0 |
| Not Vulnerable: | |
Discussion
CSLiveSupport Remote Command Execution Vulnerability
csLiveSupport is a script for providing live web support. It will run on most Unix and Linux variants, as well as Microsoft operating systems.
csLiveSupport is prone to an issue which may enable an attacker to execute Perl code with the privileges of the webserver process.
For exploitation to be successful, the attacker must pass properly URL encoded Perl code in CGI parameters via a web request. For example:
http://host/cgi-bin/csLiveSupport.cgi?command=savesetup&setup=PERL_CODE_HERE
csLiveSupport is a script for providing live web support. It will run on most Unix and Linux variants, as well as Microsoft operating systems.
csLiveSupport is prone to an issue which may enable an attacker to execute Perl code with the privileges of the webserver process.
For exploitation to be successful, the attacker must pass properly URL encoded Perl code in CGI parameters via a web request. For example:
http://host/cgi-bin/csLiveSupport.cgi?command=savesetup&setup=PERL_CODE_HERE