Microsoft IIS 1.0 / Netscape Server 1.0/1.12 / OReilly WebSite Professional 1.1b - '.cmd' / '.CMD' Remote Command Execution
Author: anonymous
type: remote
platform: windows
port:
date_added: 1996-03-01
date_updated: 2012-08-12
verified: 1
codes: CVE-1999-0233;OSVDB-1674
tags:
aliases:
screenshot_url:
application_url:
raw file: 20445.txt
type: remote
platform: windows
port:
date_added: 1996-03-01
date_updated: 2012-08-12
verified: 1
codes: CVE-1999-0233;OSVDB-1674
tags:
aliases:
screenshot_url:
application_url:
raw file: 20445.txt
IIS 1.0,Netscape Commerce Server 1.0/Communications Server 1.12,OReilly Software WebSite Professional 1.1 b BAT/.CMD Remote Command Execution source: https://www.securityfocus.com/bid/2023/info Some web servers that allow batch files to be executed via CGI are vulnerable to an attack whereby an intruder can execute commands on the target machine. This can be accomplished by submitting the command to be executed as a variable preceded by the ampersand (&) symbol, eg. http://targethost/cgi-bin/batfile.bat?&hostile_command. This apparently causes the server to call the function: system("batfile.bat &hostile_command") which the command interpreter interprets as separate commands. Microsoft IIS 1.0 is vulnerable to this attack whether or not the .BAT file requested even exists. Successfully exploiting this vulnerability allows an attacker to execute commands on the target machine with the privileges of the web server. This vulnerability may also be exploited via . CMD files. A request similar to the following is used to exploit this: http://targethost/cgi-bin/test.bat?&dir Variations may be possible or necessary, depending on the specific web server and configuration.
Copyright © 2024 Irfan TOOR all rights reserved.