From: Secunia Security Advisories (sec-advsecunia.com)
Date: Mon Jul 07 2003 - 03:38:31 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

TITLE:
CCBill whereami.cgi Arbitrary Command Execution Vulnerability

READ ONLINE:
http://www.secunia.com/advisories/9191/

CRITICAL:
Highly critical

IMPACT:
System access

WHERE:
From remote

SOFTWARE:
CCBill whereami.cgi

DESCRIPTION:
A vulnerability has been reported in CCBill whereami.cgi, which can
be exploited by malicious people to compromise a vulnerable system.

It is possible to supply system commands to the "g" parameter, which
allows execution of arbitrary commands with the privileges of the web
service.

An example was included in the original advisory:
http://[victim]/ccbill/whereami.cgi?g=cat%20../../../../etc/password

SOLUTION:
Remove the vulnerable CGI script. Use another product.

REPORTED BY / CREDITS:
Tri Huynh

----------------------------------------------------------------------

Secunia recommends that you verify all advisories you receive, by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

Contact details:
Web : http://www.secunia.com/
E-mail : supportsecunia.com
Tel : +44 (0) 20 7016 2693
Fax : +44 (0) 20 7637 0419

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories

----------------------------------------------------------------------

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]