Web+ Remote Command Execution Vulnerability

vendor:

Web+

by:

SecurityFocus

7.5

CVSS

HIGH

Remote Command Execution

CWE

Product Name: Web+

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux

2001

Web+ Remote Command Execution Vulnerability

Web+ is a development language for use in creating web-based client/server applications. In Linux versions of the product, an example script installed in Web+ (Web+Ping) which fails to correctly filter shell meta characters. As a result, parameters passed to this script may contain malicious shell commands, allowing an attacker to remotely execute or read any file which is accessible by the Web+ user. To exploit simply place a '|' after the parameter you which to provide to ping and then the command you wish to execute. For example, by entering '127.0.0.1 | cat /etc/passwd' in the host destination box, an attacker can be presented with the contents of the /etc/passwd file.

Mitigation:

Ensure that all input is properly sanitized and filtered before being passed to the Web+Ping script.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/1725/info

Web+ is a development language for use in creating web-based client/server applications.

In Linux versions of the product, an example script installed in Web+ (Web+Ping) which fails to correctly filter shell meta characters. As a result, parameters passed to this script may contain malicious shell commands, allowing an attacker to remotely execute or read any file which is accessible by the Web+ user.

Windows NT versions of Web+ are apparently not vulnerable.

To exploit simply place a '|' after the parameter you which to provide to
ping and then the command you wish to execute.

e.g:
Goto:
http://target/cgi-bin/webplus.cgi?Script=/webplus/webping/webping.wml

Then type in host destination box:
127.0.0.1 | cat /etc/passwd

You will then be presented with the contents of the /etc/passwd file.