Description
dcboard.cgi in DCForum 2000 1.0 allows remote attackers to execute arbitrary commands by uploading a Perl program to the server and using a .. (dot dot) in the AZ parameter to reference the program.
References
- http://www.dcscripts.com/FAQ/sec_2001_03_31.html
- 3862 vdb-entry
- 2611 vdb-entry
- 20010416 qDefense Advisory: DCForum allows remote read/write/execute mailing-list
- dcforum-az-expr(6392) vdb-entry