Sponsored Content
Top Forums Web Development Accessing a Perl CGI script, security issue Post 302339164 by pludi on Thursday 30th of July 2009 01:31:46 AM
Old 07-30-2009
Usually, no.
But generally, 3 ways come to mind:
  • If the HTTP server is configured wrong and doesn't recognize the scripts as executables, and serves the content instead
  • If another application on the same server is vulnerable to relative path errors, eg instead of calling /xyz/abc.html the attacker can call /xyz/../../cgi-bin/script.pl
  • If you've got a script that uses templates with variables passed through POST. Those could be set also via GET and potentially serve content you wanted hidden
 

10 More Discussions You Might Find Interesting

1. UNIX for Advanced & Expert Users

concurrency issue while Accessing Mail Box from shell script

Hi Bros, I am in a serious trouble with concurrency issue while using mailx. I have a shell script which reads all the emails of a unix user account and create a copy (another mbox for processing and archive purpose). This script works fine for 99.99% of the time but sometime it start creating... (2 Replies)
Discussion started by: Sumit_Fundoo
2 Replies

2. Shell Programming and Scripting

[Perl] Accessing array elements within a sed command in Perl script

I am trying to use a script to replace the header of each file, whose filename are stored within the array $test, using the sed command within a Perl script as follows: $count = 0; while ( $count < $#test ) { `sed -e 's/BIOGRF 321/BIOGRF 332/g' ${test} > 0`; `cat 0 >... (2 Replies)
Discussion started by: userix
2 Replies

3. Shell Programming and Scripting

call shell script from perl cgi script problem

hi,, i have perl scipt with line : system('./try.sh $t $d $m'); in shell scipt try.sh i have the line: echo $1 its not printing value of $t that i hav passed..y is it so..i am running it from apache web server (2 Replies)
Discussion started by: raksha.s
2 Replies

4. Web Development

in cgi perl script a form

hi,i hav a form in cgi perl script.this script accepts a value from user from another html form, and depending upon this value,i need to disable /enable radio buttons in cgi-perl script wen second page is displayed on executing cgi perl script.how do i do it using javascript? (0 Replies)
Discussion started by: raksha.s
0 Replies

5. Web Development

perl cgi script not working

Hello, Met a problem learning perl cgi script. 1 #!/usr/bin/perl -wT 2 3 use strict; 4 use CGI qw(:standard); 5 6 my $q = new CGI; 7 8 my $filename = $q->param('/home/yifangt/hello.cgi'); 9 my $contenttype = $q->uploadInfo($filename)->{'Content-Type'}; 10... (5 Replies)
Discussion started by: yifangt
5 Replies

6. Web Development

problem with exporting vairable from one perl cgi to another perl cgi script while redirecting.

Can anyone tell me how to export a variable from one perl CGI script to another perl cgi script when using a redirect. Upon running the login.pl the user is prompted to enter user name and password. Upon entering the correct credentials (admin/admin) the user is redirected to welcome page. My... (3 Replies)
Discussion started by: Arun_Linux
3 Replies

7. Programming

CGI Perl script to execute bash script- unable to create folder

Hi I have a bash script which takes parameters sh /tmp/gdg.sh -b BASE-NAME -n 1 -s /source/data -p /dest/data/archive -m ARC gdg.sh will scan the /source/data and will move the contents to /dest/data/archive after passing through some filters. Its working superb from bash I have... (0 Replies)
Discussion started by: rakeshkumar
0 Replies

8. Shell Programming and Scripting

Perl : embedding java script with cgi perl script

Hi All, I am aware that html tags can be embedded in cgi script as below.. In the same way is it possible to embed the below javascript in perl cgi script ?? print("<form action="action.htm" method="post" onSubmit="return submitForm(this.Submitbutton)">"); print("<input type = "text"... (1 Reply)
Discussion started by: scriptscript
1 Replies

9. Shell Programming and Scripting

Perl cgi pages out of cgi-bin folder in WINDOWS

Hi team, I have a typical problem with cgi pages in apache webserver in WINDOWS I am able to execute(display) the pages that are saved in cgi-bin folder. But I am not able to execute the pages stored in htdocs or other folder other than cgi-bin folder. Could anyone please let me know how... (1 Reply)
Discussion started by: scriptscript
1 Replies

10. Shell Programming and Scripting

Perl CGI : unable to download the excel sheet from perl cgi page

Hi All, I have written an cgi perl script that displays an image(Excel image) and when clicked on that Image I need to download a excel sheet. I made sure that excel sheet exists in the folder with the given name but still I am not able to download the sheet. print "<center><table... (2 Replies)
Discussion started by: scriptscript
2 Replies
subst(n)						       Tcl Built-In Commands							  subst(n)

__________________________________________________________________________________________________________________________________________________

NAME
subst - Perform backslash, command, and variable substitutions SYNOPSIS
subst ?-nobackslashes? ?-nocommands? ?-novariables? string _________________________________________________________________ DESCRIPTION
This command performs variable substitutions, command substitutions, and backslash substitutions on its string argument and returns the fully-substituted result. The substitutions are performed in exactly the same way as for Tcl commands. As a result, the string argument is actually substituted twice, once by the Tcl parser in the usual fashion for Tcl commands, and again by the subst command. If any of the -nobackslashes, -nocommands, or -novariables are specified, then the corresponding substitutions are not performed. For example, if -nocommands is specified, command substitution is not performed: open and close brackets are treated as ordinary characters with no special interpretation. Note that the substitution of one kind can include substitution of other kinds. For example, even when the -novariables option is speci- | fied, command substitution is performed without restriction. This means that any variable substitution necessary to complete the command | substitution will still take place. Likewise, any command substitution necessary to complete a variable substitution will take place, even | when -nocommands is specified. See the EXAMPLES below. | If an error occurs during substitution, then subst will return that error. If a break exception occurs during command or variable substi- | tution, the result of the whole substitution will be the string (as substituted) up to the start of the substitution that raised the excep- | tion. If a continue exception occurs during the evaluation of a command or variable substitution, an empty string will be substituted for | that entire command or variable substitution (as long as it is well-formed Tcl.) If a return exception occurs, or any other return code is | returned during command or variable substitution, then the returned value is substituted for that substitution. See the EXAMPLES below. | In this way, all exceptional return codes are ``caught'' by subst. The subst command itself will either return an error, or will complete | successfully. EXAMPLES
When it performs its substitutions, subst does not give any special treatment to double quotes or curly braces (except within command sub- stitutions) so the script set a 44 subst {xyz {$a}} returns ``xyz {44}'', not ``xyz {$a}'' and the script | set a "p} q {r" | subst {xyz {$a}} | return ``xyz {p} q {r}'', not ``xyz {p} q {r}''. | When command substitution is performed, it includes any variable substitution necessary to evaluate the script. | set a 44 | subst -novariables {$a [format $a]} | returns ``$a 44'', not ``$a $a''. Similarly, when variable substitution is performed, it includes any command substitution necessary to | retrieve the value of the variable. | proc b {} {return c} | array set a {c c [b] tricky} | subst -nocommands {[b] $a([b])} | returns ``[b] c'', not ``[b] tricky''. | The continue and break exceptions allow command substitutions to prevent substitution of the rest of the command substitution and the rest | of string respectively, giving script authors more options when processing text using subst. For example, the script | subst {abc,[break],def} | returns ``abc,'', not ``abc,,def'' and the script | subst {abc,[continue;expr 1+2],def} | returns ``abc,,def'', not ``abc,3,def''. | Other exceptional return codes substitute the returned value | subst {abc,[return foo;expr 1+2],def} | returns ``abc,foo,def'', not ``abc,3,def'' and | subst {abc,[return -code 10 foo;expr 1+2],def} | also returns ``abc,foo,def'', not ``abc,3,def''. SEE ALSO
Tcl(n), eval(n), break(n), continue(n) KEYWORDS
backslash substitution, command substitution, variable substitution Tcl 7.4 subst(n)
All times are GMT -4. The time now is 08:37 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy