Bugtraq mailing list archives
Re: Technical Details of Urlcount.cgi Vulnerability
From: Tom Hanlin <tom () powerbasic com>
Date: 3 Feb 2004 22:40:24 -0000
In-Reply-To: <000501c226a1$c0f58060$e62d1c41 () kc rr com>
When I informed Summit Computer Networks' Scott Slater about the Urlcount.cgi vulnerability, he replied to me that the application was property of PowerBASIC, and that he would forward it on. Hearing nothing from either Slater, or PowerBASIC, Inc. in nearly two weeks, and in response to requests for information from list readers, I have decided to make details of the vulnerability public.
I gather it never occurred to you to contact PowerBASIC or even to follow up with Mr. Slater. Thank you so much. If I hadn't run across this case on an unrelated web search, PowerBASIC might never have heard of the problem. Urlcount.cgi was based on the PowerBASIC sample program, EZCount, which is purely introductory in nature: "hello, world!"-type code, not designed or intended for practical use. But, it's a perfectly good idea to put safety first, and we'll have an update out shortly.
Current thread:
- Re: Technical Details of Urlcount.cgi Vulnerability Tom Hanlin (Feb 03)