Question: (a) Below is a short POST-method CGI script - it reads a line of the form field-name-value from standard input, and then executes the
(a) Below is a short POST-method CGI script - it reads a line of the form "field-name-value" from standard input, and then executes the last command (in the line $result = 'last ...') to see if the user name "value" has logged in recently. Describe how to construct an input that executes an arbitrary command with the privileges of the script. Explain how your input will cause the program to execute your command, and suggest how the code could be changed to avoid the problem. #! /usr/bin/perl print "content-type: text/html "; ($field_name, $username_to_look_for) = chomp $username_to_look_for; split (/=/, ); $result = 'last -1000 | grep $username_to_look_for'; if ($result) { print "$username_to_look_for has logged in recently. "; } else { print "$username_to_look_for has NOT logged in recently. "; } print " ";
Step by Step Solution
There are 3 Steps involved in it
The given CGI script is vulnerable to command injection because it directly uses the user input in t... View full answer
Get step-by-step solutions from verified subject matter experts
