Command Injection in Kootenay Web Inc's Whois

vendor:

Whois

by:

SecurityFocus

7.5

CVSS

HIGH

Command Injection

CWE

Product Name: Whois

Affected Version From: v.1.9

Affected Version To: v.1.9

Patch Exists: N/A

Related CWE: N/A

CPE: a:kootenay_web_inc:whois

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux

2001

Command Injection in Kootenay Web Inc’s Whois

Kootenay Web Inc's Whois (release v.1.9) is vulnerable to command injection due to a failure to properly check user-supplied input to a form variable for shell metacharacters. A malicious remote user can trick the script into executing arbitrary code on the host system, allowing them to gain local shell access to the system with the privileges of the webserver.

Mitigation:

Input validation should be used to ensure that user-supplied data is properly sanitized and does not contain malicious code.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/1883/info

whois is a utility used to find general information and technical details about registered domain names. A vulnerability exists in Kootenay Web Inc's Whois (release v.1.9), a web interface to whois running on a linux server. 

Due to a failure to properly check user-supplied input to a form variable for shell metacharacters, a malicious remote user can trick the script into executing arbitrary code on the host system. At that point an attacker can gain local shell access to the system with the privileges of the webserver. Further compromise (eg, root) may follow.

Unsafe code:
$site = $query->param('whois');
....
$app = `whois $site`;
print "$app .......

Proof of concept:
Type ";id" (without the quotes) into the input box.