Re: htaccess with apache

["A.D.Douma" <addouma () home nl>]

Hello,

I had a similair problem with a cgi script that used a <input type='hidden'
name='success' value=succes.'html'> to point the clients browser to the
"transaction complete page".

Because of this an attacker could read every file on the webserver. Luckily
the /etc/passwd file was shadowed. My question is what else could an
attacker do? Would command execution be possible?

Thanks