PT-2002-2576 · Rlaj · Rlaj Whois Cgi Script

Published 2002-12-31 · Updated 2008-09-05 · CVE-2002-1854

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Rlaj whois CGI script (whois.cgi) version 1.0

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the domain name field. This can be done by injecting malicious input into the field, potentially leading to unauthorized access and control.

Recommendations For version 1.0, consider restricting access to the whois.cgi script until a patch is available, or apply input validation to prevent shell metacharacter injection in the domain name field.

Fix

Related Identifiers

CVE-2002-1854

Affected Products

Rlaj Whois Cgi Script

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2002-1854 · Security Note
• http://iss.net/security_center/static/9439.php · Note
• http://online.securityfocus.com/archive/1/279268 · Note
• http://securityfocus.com/bid/5113 · Note