Check or Attack Name: vulncgi

The /cgi-bin was found to be potentially vulnerable. A common web server misconfiguration is to put shell interpreters (such as sh, csh, etc.) in the cgi-bin directory. Also, early web server documentation said to place CGI script interpreters such as Perl, Tcl, etc. in the cgi-bin directory. This placement can become a problem because it allows remote users to execute commands through the interpreters. Specially formatted HTTP requests can cause these shells to execute commands, for example, to e-mail password files.

Command interpreters such as sh or perl should never be located in /cgi-bin. Evaluate locally authored CGI executables to make sure they do not pass unvalidated user-supplied data to system commands.

CERT Advisory CA-96.11, Interpreters in CGI bin Directories, http://www.cert.org/ftp/cert_advisories/CA-96.11.interpreters_in_cgi_bin_dir