CVE-2003-0770
IkonBoard <= 3.1.2a - Remote Code Execution via Lang Cookie Injection
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2003-0770. PoCs published by snooq, Nick Cleaton.
AI-analyzed exploit summary This Perl script exploits CVE-2003-0770, an arbitrary command execution vulnerability in IkonBoard 3.1.1 due to insufficient sanitization of user-supplied cookie data. The exploit injects a malicious payload into the 'lang' cookie, which is then executed by the vulnerable CGI script.
Description
FUNC.pm in IkonBoard 3.1.2a and earlier, including 3.1.1, does not properly cleanse the "lang" cookie when it contains illegal characters, which allows remote attackers to execute arbitrary code when the cookie is inserted into a Perl "eval" statement.
Exploits (2)
This Perl script exploits CVE-2003-0770, an arbitrary command execution vulnerability in IkonBoard 3.1.1 due to insufficient sanitization of user-supplied cookie data. The exploit injects a malicious payload into the 'lang' cookie, which is then executed by the vulnerable CGI script.
This Perl script exploits CVE-2003-0770, an arbitrary command execution vulnerability in IkonBoard due to insufficient sanitization of user-supplied cookie data. It sends a maliciously crafted 'lang' cookie to execute arbitrary commands, specifically dumping environment variables in this PoC.