Beefy Boxes and Bandwidth Generously Provided by pair Networks
vroom Perl: the Markov chain saw  Warning our Fellow Monks  by
Ovid (Cardinal) on Oct 11, 2000 at 00:24 UTC
( #36121=monkdiscuss: print w/ replies, xml ) Need Help??  Take
a look at the code in this node. Since it didn't have taint
checking (amongst many other problems), I was rather concerned
about it. A quick review of this code revealed the following
line of code. Where does the filename come from? open(IN,
"$filepath/$siteinfo[1]"); It appears to come from here (near
the start of the program): $query_string = $ENV{'QUERY_STRING'};
@search = split(/&/,$query_string); @info = split(/=/,
$search[0]); @siteinfo = split(/-/, $info[1]); Guess what the
following URL does (assuming it's pointing to that CGI script):|
If we use that code with that URL, we have /bin/ls| in the
filename to be opened. That trailing pipe causes /bin/ls to be
executed instead of opened.  Well, that's interesting.  I can
now execute any executable on the server that the the