[4861] in bugtraq
Re: Vulnerability in websendmail
daemon@ATHENA.MIT.EDU (Randal Schwartz)
Tue Jul 8 10:45:35 1997
Date: Tue, 8 Jul 1997 07:11:27 -0700
Reply-To: Randal Schwartz <merlyn@STONEHENGE.COM>
From: Randal Schwartz <merlyn@STONEHENGE.COM>
X-To: Razvan Dragomirescu <drazvan@kappa.ro>
To: BUGTRAQ@NETSPACE.ORG
In-Reply-To: Razvan Dragomirescu's message of "Fri, 4 Jul 1997 12:16:31 +0300"
>>>>> "Razvan" == Razvan Dragomirescu <drazvan@kappa.ro> writes:
Razvan> As many other cgi-bin programs, this one does not check for special
Razvan> characters in the user input.
Razvan> Here's what it does:
Razvan> (...)
Razvan> $cmd="| $MAILBIN $VAR_receiver";
Razvan> open (PIPEOUT, $cmd);
It really amazes me how many newbie Perl hackers:
(1) ignore the CGI Security FAQ (especially the parts about perl), or
(2) roll their own mail sending stuff, instead of using Net::SMTP
or the more powerful Mail::Tools package, both found in the CPAN.
On second thought, maybe it's not amazing. :-)
--
Name: Randal L. Schwartz / Stonehenge Consulting Services (503)777-0095
Keywords: Perl training, UNIX[tm] consulting, video production, skiing, flying
Email: <merlyn@stonehenge.com> Snail: (Call) PGP-Key: (finger merlyn@ora.com)
Web: <A HREF="http://www.stonehenge.com/merlyn/">My Home Page!</A>
Quote: "I'm telling you, if I could have five lines in my .sig, I would!" -- me
