[7185] in bugtraq
ePerl: bad handling of ISINDEX queries
daemon@ATHENA.MIT.EDU (Tiago Luz Pinto)
Wed Jul 8 12:23:50 1998
Date: Mon, 6 Jul 1998 22:39:24 -0300
Reply-To: Tiago Luz Pinto <tiago@EPS.UFSC.BR>
From: Tiago Luz Pinto <tiago@EPS.UFSC.BR>
To: BUGTRAQ@NETSPACE.ORG
(ePerl is an embedded Perl Interpreter for HTTP servers)
* Description:
Incorrect Handling of ISINDEX queries (command line argument)
when ePerl runs as a nph-cgi/cgi.
* Cause:
According with the CGI/1.1 specification, the HTTP
server executes CGI's passing the ISINDEX field as a command
line argument. When ePerl runs and gets this argument
(argc > 1), it fails to set MODE_CGI, then tries to
open the argument for parsing/executing.
This can lead to arbitrary Perl code being executed on
the server.
* Example:
http://foo.com/some/dir/doit.phtml?/home/ftp/incoming/executemycode.phtml
+----------------------------------------------------------------------+
| Tiago Luz Pinto tiago@eps.ufsc.br |
| |
| Network Administrator - Department of Production Engineering |
| Federal University of Santa Catarina - Brazil |
+----------------------------------------------------------------------+
