The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

[Security] Cpanel Guestbook exploit

Discussion in 'Security' started by Radio_Head, Apr 23, 2003.

  1. Radio_Head

    Radio_Head Well-Known Member

    Joined:
    Feb 15, 2002
    Messages:
    2,051
    Likes Received:
    1
    Trophy Points:
    38
    I have found on a security site a perl file to exploit the Cpanel Guestbook. It spawns a bash shell with the uid of the webserver.


    The exploit dated Mar 14 2003.
    Before reporting links and more details, I wish to know if Darkorb
    knows the problem and if the problem has been fixed.
     
  2. sexy_guy

    sexy_guy Well-Known Member

    Joined:
    Mar 19, 2003
    Messages:
    848
    Likes Received:
    0
    Trophy Points:
    16
    I wouldnt be surprised if its VULN! Seeing how they fixed formmail, NOT, everyone should have disabled these scripts because they are still VULN! Im wondering why so many have been rooted and hacked lately and i wouldnt be surprised if this guestbook is still a major security hole. I think i will just go and disable it. That way, it will be one less security hole exploitable on my box.
     
  3. Curious Too

    Curious Too Well-Known Member

    Joined:
    Aug 31, 2001
    Messages:
    427
    Likes Received:
    0
    Trophy Points:
    16
    cPanel Access Level:
    Root Administrator
    This is very old news.

    http://forums.cpanel.net/showthread.php?s=&threadid=5284&highlight=guestbook.cgi
     
  4. haze

    haze Well-Known Member

    Joined:
    Dec 21, 2001
    Messages:
    1,550
    Likes Received:
    3
    Trophy Points:
    38
  5. Radio_Head

    Radio_Head Well-Known Member

    Joined:
    Feb 15, 2002
    Messages:
    2,051
    Likes Received:
    1
    Trophy Points:
    38
  6. LinuxFreaky

    LinuxFreaky Well-Known Member

    Joined:
    Sep 22, 2001
    Messages:
    87
    Likes Received:
    0
    Trophy Points:
    6
    Just tried it and got the prompt, but runnig commands such as "ls" or "pwd" yielded empty results. Does that mean it ain't working?
     
Loading...

Share This Page