Home page logo
/

bugtraq logo Bugtraq mailing list archives

infosrch.cgi vulnerability (IRIX 6.5)
From: rpc () INETARENA COM (rpc)
Date: Thu, 2 Mar 2000 11:12:41 -0800


Hi,

InfoSearch is a web-based interface to books, manpages, and relnotes,
distributed by SGI.

No suprises here, no parsing is done on the 'fname' variable before being
passed to man2html. (i.e. when cmd is 'getdoc' and db is 'man').

Also, fname is the _full path_ to the manpage/relnote! I'm sure there's
more vulnerabilities lurking about in this script.

Example:
http://my.really.expensive.sgi.box/cgi-bin/infosrch.cgi?cmd=getdoc&db=man&fname=|/bin/id

Thanks,
--jared <rpc () inetarena com> || <h () ckz org>
Security Specialist -- Internet Arena


  By Date           By Thread  

Current thread:
  • infosrch.cgi vulnerability (IRIX 6.5) rpc (Mar 02)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]