header-logo
Suggest Exploit
vendor:
Super Site Searcher
by:
SecurityFocus
7.5
CVSS
HIGH
Remote Command Execution
78
CWE
Product Name: Super Site Searcher
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2002

Super Site Searcher Remote Command Execution Vulnerability

Super Site Searcher is prone to remote command execution. Shell metacharacters are not adequately filtered from query string parameters in a request to the vulnerable search engine script. The parameters are then used in a function which passes commands directly through the shell. A remote attacker may exploit this condition to execute arbitrary commands on the shell with the privileges of the webserver process.

Mitigation:

Filter user input to prevent malicious commands from being executed.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/5605/info

Super Site Searcher is prone to remote command execution. Shell metacharacters are not adequately filtered from query string parameters in a request to the vulnerable search engine script. The parameters are then used in a function which passes commands directly through the shell.

A remote attacker may exploit this condition to execute arbitrary commands on the shell with the privileges of the webserver process.

Simple Site Searcher, released by the same vendor, is also prone to this issue. 

http://target/searchenginepath/site_searcher.cgi?page=|command|