Zap Book Server Side Include Arbitrary Command Execution Vulnerability
BID:5130
Info
Zap Book Server Side Include Arbitrary Command Execution Vulnerability
| Bugtraq ID: | 5130 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 30 2002 12:00AM |
| Updated: | Jun 30 2002 12:00AM |
| Credit: | Vulnerability discovery credited to DownBload <[email protected]>. |
| Vulnerable: |
Zap Book Zap Book 1.0.3 |
| Not Vulnerable: | |
Discussion
Zap Book Server Side Include Arbitrary Command Execution Vulnerability
Zap Book is a freely available, open source guest book. It is designed for Unix and Linux operating systems.
Zap Book does not adequately sanitize user-supplied input in guest book entries. Because of this, it is possible to pass along commands via server-side includes that could allow a remote user to execute commands on the local host.
Zap Book is a freely available, open source guest book. It is designed for Unix and Linux operating systems.
Zap Book does not adequately sanitize user-supplied input in guest book entries. Because of this, it is possible to pass along commands via server-side includes that could allow a remote user to execute commands on the local host.
Exploit / POC
Zap Book Server Side Include Arbitrary Command Execution Vulnerability
No exploit is required for this vulnerability.
No exploit is required for this vulnerability.
Solution / Fix
Zap Book Server Side Include Arbitrary Command Execution Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Zap Book Server Side Include Arbitrary Command Execution Vulnerability
References:
References: