Re: shell script cgi

On Thu, 14 Nov 2002, c jones wrote:

>I have found the line below in an sh cgi program, and believe I can
[snip]
>ua=`echo "$HTTP_USER_AGENT" | sed "s#\;##g"`

The quotes around HTTP_USER_AGENT prevent any "chained commands", e.g. 'Mozilla 6; rm -rf /'.

Perhaps you're confusing the backticks; they execute the line given in the script, not the result of the 'echo ...; sed'.

I don't see any way here to manipulate the input to execute arbitrary code.

Cheers,

Phil Received on Sat Nov 16 04:14:07 2002