Executive Summary

Informations
Name CVE-2001-1130 First vendor Publication 2001-08-02
Vendor Cve Last vendor Modification 2017-10-10

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score 7.5 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Sdbsearch.cgi in SuSE Linux 6.0-7.2 could allow remote attackers to execute arbitrary commands by uploading a keylist.txt file that contains filenames with shell metacharacters, then causing the file to be searched using a .. in the HTTP referer (from the HTTP_REFERER variable) to point to the directory that contains the keylist.txt file.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1130

CPE : Common Platform Enumeration

TypeDescriptionCount
Os 6

OpenVAS Exploits

Date Description
2008-10-24 Name : sdbsearch.cgi
File : nvt/sdbsearch.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
598 SuSE Support Data Base sbsearch.cgi Arbitrary Command Execution

The SuSe Support Data Base search script (sbsearch.cgi) contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to script trusting the HTTP_REFERER field in a web request as the valid path to 'keyfile.txt'. If a malicious 'keyfile.txt' file is created on the server an attacker can set HTTP_REFERER to the path of the bogus 'keyfile.txt' and sbsearch.cgi will execute the commands in the file.

Snort® IPS/IDS

Date Description
2014-01-10 sdbsearch.cgi access
RuleID : 1476-community - Revision : 21 - Type : SERVER-WEBAPP
2014-01-10 sdbsearch.cgi access
RuleID : 1476 - Revision : 21 - Type : SERVER-WEBAPP

Nessus® Vulnerability Scanner

Date Description
2001-08-13 Name : Arbitrary commands may be run on the remote server.
File : sdbsearch.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source Url
BUGTRAQ http://www.securityfocus.com/archive/1/201216
SUSE http://www.novell.com/linux/security/advisories/2001_027_sdb_txt.html
XF https://exchange.xforce.ibmcloud.com/vulnerabilities/7003

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
Date Informations
2021-05-04 12:01:30
  • Multiple Updates
2021-04-22 01:01:39
  • Multiple Updates
2020-05-23 00:14:46
  • Multiple Updates
2017-10-10 09:23:23
  • Multiple Updates
2014-02-17 10:24:08
  • Multiple Updates
2014-01-19 21:21:33
  • Multiple Updates
2013-05-11 12:06:19
  • Multiple Updates