CVE-2001-0436 dcboard.cgi in DCForum 2000 1.0 allows remote attackers to execute arbitrary commands by uploading a Perl program to the server and using a .. (dot dot) in the AZ parameter to reference the program.
HighCVSS 7.5
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
dcboard.cgi in DCForum 2000 1.0 allows remote attackers to execute arbitrary commands by uploading a Perl program to the server and using a .. (dot dot) in the AZ parameter to reference the program.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dcscripts dcforum | = 1.0 | No fix listed |
| dcscripts dcforum | = 2.0 | No fix listed |
| dcscripts dcforum | = 3.0 | No fix listed |
| dcscripts dcforum | = 4.0 | No fix listed |
| dcscripts dcforum | = 5.0 | No fix listed |
| dcscripts dcforum | = 6.0 | No fix listed |
| dcscripts dcforum 2000 | = 1.0 | No fix listed |
References
- 20010416 qDefense Advisory: DCForum allows remote read/write/execute exploit mailing-list patch vendor-advisory
- www.dcscripts.com exploit patch
- 3862 vdb-entry
- 2611 patch vdb-entry vendor-advisory
- dcforum-az-expr(6392) vdb-entry