Results 1 to 2 of 2

Thread: New CGI bug

  1. #1

    Angry New CGI bug

    The search.cgi script included with the AHG Search Engine does not adequately filter input. Due to lack of sufficient input sanitization, it is possible for a remote user to pass semi-colon ( and pipe (|) characters through a search request. This can result in the commands encapsulated between the symbols being executed with the privileges of the web server.


    Read more at www.xatrix.org

  2. #2
    PHP/PostgreSQL guy
    Join Date
    Dec 2001
    Posts
    1,164
    Jesus, you'd think they'd check for these things...escape both the pipe | and the semicolon ; you fsck-nuts! Do LITERAL translation and you can botch things...do escaped translations and you'll be fine! Check length, bad chars, etc etc... *sigh* I can tell they hired a n00b. I'm not saying I've never done things like that before but I know when I send something out the door with my name on it code-wise, I've looked at it repeatedly and tried to break it internally.
    We the willing, led by the unknowing, have been doing the impossible for the ungrateful. We have done so much with so little for so long that we are now qualified to do just about anything with almost nothing.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •