Guestex Shell Command Execution Vulnerability

2006.02.25

Credit: alex evuln com

Risk: High

Local: No

Remote: Yes

CVE: CVE-2006-0777

CWE: CWE-Other

CVSS Base Score: 7.5/10

Impact Subscore: 6.4/10

Exploitability Subscore: 10/10

Exploit range: Remote

Attack complexity: Low

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

New eVuln Advisory:
Guestex Shell Command Execution Vulnerability
http://evuln.com/vulns/76/summary.html

--------------------Summary----------------
eVuln ID: EV0076
CVE: CVE-2006-0777
Software: Guestext
Sowtware's Web Site: http://www.teca-scripts.com/
Versions: 1.0
Critical Level: Dangerous
Type: Command Execution
Class: Remote
Status: Unpatched. No reply from developer(s)
Exploit: Available
Solution: Not Available
Discovered by: Aliaksandr Hartsuyeu (eVuln.com)

-----------------Description---------------
Vulnerable Script: guestex.pl

Variable $form{'email'} isn't properly sanitized. This can be used to execute arbitrary shell commands.

System access is possible.

--------------Exploit----------------------
Available at: http://evuln.com/vulns/76/exploit.html

--------------Solution---------------------
No Patch available.

--------------Credit-----------------------
Discovered by: Aliaksandr Hartsuyeu (eVuln.com)

Regards,
Aliaksandr Hartsuyeu
http://evuln.com - Penetration Testing Services
.

See this note in RAW Version

Vote for this issue:

50%

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

Guestex Shell Command Execution Vulnerability

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Guestex Shell Command Execution Vulnerability

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.