CVE-2005-1289

e-cart 2004 1.1 - Remote Command Execution via Shell Metacharacters in art Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2005-1289. PoCs published by z.

AI-analyzed exploit summary This Perl script exploits a command injection vulnerability in E-Cart E-Commerce Software (CVE-2005-1289) by injecting a reverse shell payload via the 'art' parameter in the index.cgi script. It generates a Perl-based reverse shell script on the target system and triggers it to connect back to the attacker's specified IP and port.

Description

index.cgi in E-Cart 2004 1.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) art and possibly (2) cat parameters.

Exploits (1)

exploitdb WORKING POC VERIFIED

by z · perlwebappscgi

https://www.exploit-db.com/exploits/954

View Code ZIP pw:eip

This Perl script exploits a command injection vulnerability in E-Cart E-Commerce Software (CVE-2005-1289) by injecting a reverse shell payload via the 'art' parameter in the index.cgi script. It generates a Perl-based reverse shell script on the target system and triggers it to connect back to the attacker's specified IP and port.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: E-Cart E-Commerce Software <= 2004 v1.1

No auth needed

Prerequisites: Target must have write permissions in /tmp directory · Target must have Perl installed · Network connectivity from target to attacker's machine

MITRE ATT&CK

T1189 - Drive-by Compromise T1059 - Command and Scripting Interpreter T1068 - Exploitation for Privilege Escalation

devstral-2 · analyzed Feb 16, 2026 Full analysis →