CVE-2001-0436 Command injection in n/a

High 7.5 Published 24 May 2001 Updated 8 Aug 2024

Remote attackers can execute arbitrary commands by uploading a Perl program and referencing it via path traversal in the AZ parameter.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2001-0436?

CVE-2001-0436 is a high-severity command injection vulnerability in n/a, published on 24 May 2001. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

dcboard.cgi in DCForum 2000 1.0 allows remote attackers to execute arbitrary commands by uploading a Perl program to the server and using a .. (dot dot) in the AZ parameter to reference the program.

Which versions are affected by CVE-2001-0436?

It affects 2 products.

Products include Dcscripts Dcforum, Dcscripts Dcforum 2000.

How do I fix CVE-2001-0436?

No fix has been published for CVE-2001-0436 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2001-0436 being exploited?

There is no known exploitation of CVE-2001-0436 in the wild and no public exploit code.

Sources

Also known as GHSA-9968-x288-6qqr.