header-logo
Suggest Exploit
vendor:
Webserver
by:
SecurityFocus
8.8
CVSS
HIGH
Remote Command Execution
78
CWE
Product Name: Webserver
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: No
Related CWE: N/A
CPE: N/A
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2001

Remote Command Execution on Bajie Webserver

A remote user can use Bajie's built-in upload feature to place malicious scripts on Bajie webservers. These uploaded scripts are placed in known destination directories and can be automatically executed. Unfortunately Bajie's CGI processor doesn't verify the CGI program exists before executing the script. Once these files are uploaded, they can be then executed as CGI scripts on the server.

Mitigation:

Ensure that the CGI processor verifies the CGI program exists before executing the script.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/2388/info

It is possible to execute arbitrary commands on a host running Bajie Webserver.

A remote user can use Bajie's built-in upload feature to place malicious scripts on Bajie webservers. These uploaded scripts are placed in known destination directories and can be automatically executed. Unfortunately Bajie's CGI processor doesn't verify the CGI program exists before executing the script.

Once these files are uploaded, they can be then executed as CGI scripts on the server. 

Upload the malicious script via:

http://target/upload.html

Execute it via:

http://target/cgi/bin//...//upload/[file name]

Navigation

Suggest Exploit

Services By CQR