Overview
User Manual does not adequately validate user input, allowing attackers to execute arbitrary commands on the server.
Description
Unix Manual (as known as manual.php) is a PHP script used to lookup and display man pages on the web. User Manual does not adequately filter user input before passing it to the shell, allowing attackers to submit and execute arbitrary commands on the server. |
Impact
Remote attackers can execute arbitrary commands on the server with privileges of the web server process. |
Solution
The CERT/CC is currently unaware of a practical solution to this problem. |
Vendor Information
672419
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
Thanks to Florian Hobelsberger of BlueScreen for reporting this vulnerability.
This document was written by Shawn Van Ittersum.
Other Information
| CVE IDs: | CVE-2001-1214 |
| Severity Metric: | 4.28 |
| Date Public: | 2001-12-15 |
| Date First Published: | 2002-09-26 |
| Date Last Updated: | 2002-09-26 22:02 UTC |
| Document Revision: | 4 |