Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.
Carello E-Commerce Server Allows Remote Command Execution
A vulnerability exists in Carello E-Commerce Server 1.2.1 for Windows NT that lets an attacker run programs located on the server by using the System Security context.
Ken Pfeil
May 14, 2001
2 Min Read
ReportedMay 14, 2001, by Defcom Labs.
VERSIONAFFECTED
Carello E-Commerce Server 1.2.1 for Windows NT
DESCRIPTION
Avulnerability exists in Carello E-Commerce Server 1.2.1 for Windows NT that letsan attacker run programs located on the server by using the System Securitycontext. The carello.dll uses full physical paths to execute its scripts insteadof paths relative to the Web root.
DEMONSTRATION
PeterGründl alsoprovided the following proof-of-concept scenario:
Typinghttp://foo.org/scripts/Carello/Carello.dll?CARELLOCODE=SITE2&VBEXE=C:..winntsystem32cmd.exe%20/c%20echo%20test>c:defcom.txtcreates a file on the server called “defcom.txt.”
VENDORRESPONSE
Thevendor, Carello, acknowledges thisvulnerability and has released version 1.3to correct this vulnerability.
CREDIT
Discoveredby PeterGründl.
About the Author
You May Also Like
.jpg?width=700&auto=webp&quality=80&disable=upscale)
