CVE-1999-1053
HighExploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
The vulnerability in guestbook.pl involves improper cleansing of user-inserted SSI commands, allowing remote attackers to execute arbitrary commands.
Risk Assessment
Organizations using Apache 1.3.9 and possibly other versions are at risk of remote code execution, which can lead to serious security breaches.
Recommendation
It is recommended to update the Apache server to the latest version and review and improve scripts to effectively cleanse input data.
Original NVD description (English source)
guestbook.pl cleanses user-inserted SSI commands by removing text between "<!--" and "-->" separators, which allows remote attackers to execute arbitrary commands when guestbook.pl is run on Apache 1.3.9 and possibly other versions, since Apache allows other closing sequences besides "-->".