classifieds.cgi
advICE :Intrusions : 2002590

Summary

Somebody has accessed this potentially vulnerable script.

Details

The classifieds.cgi script was written by Greg Mathews and is widely used by many websites. Older versions of this script do not check the input. There are many ways it can be exploited either to grab unauthorized files from the server or break into it.

There are two specific FORM fields that are of concern. The first is the <input name=return> field. It is intended that the user could enter their e-mail address. However, the attacker can add shell metacharacters to this field in order to grab files or execute programs.

The second field is <input name=mailprog>, which tells the CGI script which program it should execute in order to send e-mail. The attacker can supplied whatever program (and parameters) he/she wants. This can be used to completely compromise the server.

parametric information URL The suspicious URL. accessed Indicates whether the URL was successfully accessed. code The HTTP return code. arg The argument to the GET command (if any).

 
Version appeared: 2.5