CVE-2004-2347

Leif M. Wright Web Blog <1.1,1.1.5 - Command Injection

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2004-2347. PoCs published by ActualMInd.

AI-analyzed exploit summary This exploit leverages insufficient sanitization of shell metacharacters in Web Blog's 'blog.cgi' script, allowing remote command execution via the 'file' parameter. The vulnerability is triggered by injecting shell commands directly into the URL.

Description

blog.cgi in Leif M. Wright Web Blog 1.1 and 1.1.5 allows remote attackers to execute arbitrary commands via shell metacharacters such as '|' in the file parameter of ViewFile requests.

Exploits (1)

exploitdb WORKING POC VERIFIED

by ActualMInd · textwebappscgi

https://www.exploit-db.com/exploits/23629

View Code ZIP pw:eip

This exploit leverages insufficient sanitization of shell metacharacters in Web Blog's 'blog.cgi' script, allowing remote command execution via the 'file' parameter. The vulnerability is triggered by injecting shell commands directly into the URL.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: Web Blog (version unspecified)

No auth needed

Prerequisites: Network access to the target web server · Web Blog application installed and accessible

MITRE ATT&CK