CVE-2005-1628

WebAPP 0.9.9.2.1 - Remote Command Execution (2)

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2005-1628 has a selected CVSS score of 7.5; EIP currently links 2 catalogued exploits.

Description

apage.cgi in WebAPP 0.9.9.2.1, and possibly earlier versions, allows remote attackers to execute arbitrary commands via shell metacharacters in the f parameter.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
2

Proofs of concept

2

Catalogued exploits

ExploitDBWebAPP 0.9.9.2.1 - Remote Command Execution (2)ExploitDB exploitby Nikyt0xNot analyzed1 file
ExploitDB
PoC details
ExploitDBWebAPP 0.9.9.2.1 - Remote Command Execution (1)ExploitDB exploitby Alpha_ProgrammerExploit1 file
ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

This is a Perl script that exploits a command injection vulnerability in WebAPP 0.9.9.2.1. It sends crafted HTTP GET requests to the vulnerable 'apage.cgi' script, injecting shell commands via the 'f' parameter to download and execute a backdoor script, ultimately opening a remote shell on port 4444.

Backdoor review

No backdoor observed in reviewed code

The exploit script is a straightforward remote command execution exploit targeting a known vulnerability (CVE-2005-1628) in WebAPP. It sends crafted HTTP requests to execute commands on the target server. The commands download and execute a file from a hardcoded external URL, which is the disclosed exploit behavior. There is no concealed or misrepresented behavior that harms the operator's machine or an unrelated system.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPerl
Target softwareWebAPP 0.9.9.2.1
Attack typesCommand InjectionRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends crafted HTTP requests to execute arbitrary shell commands on a remote target, which is the definition of an exploit. It does not merely check for the vulnerability but performs actions to compromise the system.

exploits/cgi/webapps/1005.pl:5exploits/cgi/webapps/1005.pl:40-42exploits/cgi/webapps/1005.pl:46

Requirements

  • The target server must be running a vulnerable version of WebAPP (0.9.9.2.1 or possibly earlier) with the apage.cgi script accessible.exploits/cgi/webapps/1005.pl:5
  • The target server must have outbound network access to download a file from 'http://www.khatotarh.com/alpha.txt'.exploits/cgi/webapps/1005.pl:36
  • The target server must have Perl installed to execute the downloaded backdoor script.exploits/cgi/webapps/1005.pl:54

Observed behavior

  • The script constructs a malicious URL targeting 'apage.cgi' with a command injection payload in the 'f' parameter.exploits/cgi/webapps/1005.pl:40-42
  • The injected command uses 'wget' to download a file 'alpha.txt' from a remote server into the '/tmp' directory.exploits/cgi/webapps/1005.pl:36
  • A second request is sent to execute the downloaded file after renaming it to 'sirus.pl' and making it executable, which opens a backdoor on port 4444.exploits/cgi/webapps/1005.pl:54exploits/cgi/webapps/1005.pl:63
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
Payload withheldThe exploit downloads a file from this hardcoded URL to the target server and executes it. This is the disclosed remote command execution payload.exploits/cgi/webapps/1005.pl:36
Ip Port
Payload withheldThe exploit claims to open a backdoor on port 4444 of the target server. This is the disclosed result of the payload execution.exploits/cgi/webapps/1005.pl:10exploits/cgi/webapps/1005.pl:63
Review boundaries

What the analysis did not establish

  • The analysis is based solely on the provided Perl script. The actual behavior of the downloaded 'alpha.txt' backdoor is not included in the evidence and cannot be analyzed.
  • The script's effectiveness depends on the target server's configuration and the availability of the external download server, which are not verified.
  • The content of the downloaded file (alpha.txt) is not included in the evidence, so its exact behavior on the target is unknown, but this is the disclosed exploit payload, not a backdoor against the operator.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

7