Description

guestbook.pl cleanses user-inserted SSI commands by removing text between "<!--" and "-->" separators, which allows remote attackers to execute arbitrary commands when guestbook.pl is run on Apache 1.3.9 and possibly other versions, since Apache allows other closing sequences besides "-->".

Remediation

References

CVE-1999-1053

Related Vulnerabilities

Piwigo Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2021-40317)

Drupal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2008-3741)

MySQL CVE-2017-10279 Vulnerability (CVE-2017-10279)

Dotclear Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2015-8831)

MySQL CVE-2021-2055 Vulnerability (CVE-2021-2055)

Severity

High

Classification

CVE-1999-1053

Tags

Missing Update Known Vulnerabilities