Skip to content
CivetWeb: PUT + SSI = RCE.
bugpwn.com | research | #rce | #vulnerability-research | #web-security | #file-upload | #civetweb | #ssi | #cwe-434 | #embedded-http-server | #source-code-audit
Summary
How two fully legitimate CivetWeb features (authenticated PUT + SSI #exec) combine into arbitrary remote code execution, with source code analysis, live demo, and hardening recommendations.
- Published
- Collected