The Sambar server includes batch files ECHO.BAT and HELLO.BAT in the CGI directory, which allow remote attackers to execute commands via shell metacharacters.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Sambar_server | Sambar | * | 4.2 (including) |
References
- http://www.sambar.com/session/highlight?url=/syshelp/history.htm\u0026words=security+\u0026color=red
- http://www.securityfocus.com/bid/1002
- http://www.securityfocus.com/templates/archive.pike?list=1\u0026msg=38B3E60A.6A84FEC3%40cybcom.net
- http://www.sambar.com/session/highlight?url=/syshelp/history.htm\u0026words=security+\u0026color=red
- http://www.securityfocus.com/bid/1002
- http://www.securityfocus.com/templates/archive.pike?list=1\u0026msg=38B3E60A.6A84FEC3%40cybcom.net