vendor:
CGI Counter
by:
SecurityFocus
7.5
CVSS
HIGH
Remote Command Execution
78
CWE
Product Name: CGI Counter
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: N/A
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2002
Unchecked Code in George Burgyan’s CGI Counter
Due to unchecked code that handles user input in George Burgyan's CGI Counter, remote execution of arbitrary commands at the same privilege level as the web server it is running on is possible. Examples of exploitation include sending a GET request to the target web server with a command in the HTTP_X header, or sending a GET request with a command in the lang parameter.
Mitigation:
Ensure that user input is properly validated and sanitized before being used in any system commands.
