NetSight
IP …
high7.5Public exploit code

CVE-1999-1053

guestbook.pl cleanses user-inserted SSI commands by removing text between "<!--" and "-->" separators, which allows remote attackers to execute arbitrary comma…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

guestbook.pl cleanses user-inserted SSI commands by removing text between "<!--" and "-->" separators, which allows remote attackers to execute arbitrary commands when guestbook.pl is run on Apache 1.3.9 and possibly other versions, since Apache allows other closing sequences besides "-->".

Affected products

VendorProductAffected versions
ApacheHttp Server
Version 1.3.9
Matt WrightMatt Wright Guestbook
Version 2.3

References