Super Site Searcher Remote Command Execution Vulnerability
BID:5605
Info
Super Site Searcher Remote Command Execution Vulnerability
| Bugtraq ID: | 5605 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 03 2002 12:00AM |
| Updated: | Sep 03 2002 12:00AM |
| Credit: | Discovery of this issue is credited to "[email protected]" <[email protected]>. |
| Vulnerable: |
Independent Solution Super Site Searcher Independent Solution Simple Site Searcher |
| Not Vulnerable: | |
Discussion
Super Site Searcher Remote Command Execution Vulnerability
Super Site Searcher is prone to remote command execution. Shell metacharacters are not adequately filtered from query string parameters in a request to the vulnerable search engine script. The parameters are then used in a function which passes commands directly through the shell.
A remote attacker may exploit this condition to execute arbitrary commands on the shell with the privileges of the webserver process.
Simple Site Searcher, released by the same vendor, is also prone to this issue.
Super Site Searcher is prone to remote command execution. Shell metacharacters are not adequately filtered from query string parameters in a request to the vulnerable search engine script. The parameters are then used in a function which passes commands directly through the shell.
A remote attacker may exploit this condition to execute arbitrary commands on the shell with the privileges of the webserver process.
Simple Site Searcher, released by the same vendor, is also prone to this issue.
Exploit / POC
Super Site Searcher Remote Command Execution Vulnerability
This issue may be exploited with a web browser. The following example may be used to reproduce this condition:
http://target/searchenginepath/site_searcher.cgi?page=|command|
This issue may be exploited with a web browser. The following example may be used to reproduce this condition:
http://target/searchenginepath/site_searcher.cgi?page=|command|
Solution / Fix
Super Site Searcher Remote Command Execution Vulnerability
Solution:
It has been reported that the vendor has reportedly addressed this issue in Super Site Searcher. Those affected by this issue should contact the vendor about obtaining fixes for this vulnerability.
Solution:
It has been reported that the vendor has reportedly addressed this issue in Super Site Searcher. Those affected by this issue should contact the vendor about obtaining fixes for this vulnerability.
References
Super Site Searcher Remote Command Execution Vulnerability
References:
References:
- Super Site Searcher Homepage (Independent Solutions)