(a) Below is a short POST-method CGI script - it reads a line of the form...
Fantastic news! We've Found the answer you've been seeking!
Question:
Transcribed Image Text:
(a) Below is a short POST-method CGI script - it reads a line of the form "field-name-value" from standard input, and then executes the last command (in the line $result = 'last ...') to see if the user name "value" has logged in recently. Describe how to construct an input that executes an arbitrary command with the privileges of the script. Explain how your input will cause the program to execute your command, and suggest how the code could be changed to avoid the problem. #! /usr/bin/perl print "content-type: text/html\r\n\r\n<HTML><BODY>\n"; ($field_name, $username_to_look_for) = chomp $username_to_look_for; split (/=/, <>); $result = 'last -1000 | grep $username_to_look_for'; if ($result) { print "$username_to_look_for has logged in recently.\n"; } else { print "$username_to_look_for has NOT logged in recently.\n"; } print "</BODY></HTML>\n"; (a) Below is a short POST-method CGI script - it reads a line of the form "field-name-value" from standard input, and then executes the last command (in the line $result = 'last ...') to see if the user name "value" has logged in recently. Describe how to construct an input that executes an arbitrary command with the privileges of the script. Explain how your input will cause the program to execute your command, and suggest how the code could be changed to avoid the problem. #! /usr/bin/perl print "content-type: text/html\r\n\r\n<HTML><BODY>\n"; ($field_name, $username_to_look_for) = chomp $username_to_look_for; split (/=/, <>); $result = 'last -1000 | grep $username_to_look_for'; if ($result) { print "$username_to_look_for has logged in recently.\n"; } else { print "$username_to_look_for has NOT logged in recently.\n"; } print "</BODY></HTML>\n";
Expert Answer:
Answer rating: 100% (QA)
The given CGI script is vulnerable to command injection because it directly uses the user input in t... View the full answer
Related Book For
Income Tax Fundamentals 2013
ISBN: 9781285586618
31st Edition
Authors: Gerald E. Whittenburg, Martha Altus Buller, Steven L Gill
Posted Date:
Students also viewed these programming questions
-
Planning is one of the most important management functions in any business. A front office managers first step in planning should involve determine the departments goals. Planning also includes...
-
Read the articles found at the following links: Normalization in DBMS: 1NF, 2NF, 3NF and BCNF with Examples https://hackr.io/blog/dbms-normalization What is Normalization? 1NF, 2NF, 3NF & BCNF with...
-
The _____________ works out the best way to structure finances and make effective financial decisions.
-
An object initially at rest breaks into two pieces as the result of an explosion. One piece has twice the kinetic energy of the other piece. What is the ratio of the masses of the two pieces? Which...
-
Consider a particle that is at rest in the TT coordinate system of the gravitational-wave metric (27.80) before the gravitational wave arrives. In the text it is shown that the particles 4-velocity...
-
Air at \(V_{1}=800 \mathrm{~m} / \mathrm{s}, p_{1}=100 \mathrm{kPa}\), and \(T_{1}=300 \mathrm{~K}\) passes through a normal shock. Calculate the velocity \(V_{2}\), temperature \(T_{2}\), and...
-
Find the present value of (1) A single payment of $24,000 at 6 percent for 12 years, (2) 12 annual payments of $2,000 at 6 percent, (3) A single payment of $5,000 at 9 percent for five years, and (4)...
-
Fire Inc. recently issued new securities (common shares and bonds) to finance a new project with a cost $16 million. The equity issued had a flotation cost of 8%, while the debt issued had a...
-
Angela Care Homes Ltd. (Angela) operates 14 care homes for people suffering with mental illness in Western Canada. It hopes to expand to Eastern Canada over the next few years and is considering...
-
Crane Corporation's comparative balance sheets are presented below. CRANE CORPORATION Comparative Balance Sheets December 31 2022 2021 Cash $14,200 $10,000 Accounts receivable 20,700 22,900 Land...
-
Paid Phoenix Insurance $50 for February renters insurance using company VISA credit card. Record as Renter Insurance Expense. What are the Accounts and Amounts Debited? What are the Accounts and...
-
How do you record a partial payment in the Pay Bills window?
-
How can you access the Create Credit Memos/Refunds window?
-
Management has indicated that a multiple of 8x EBITDA is reasonable to value the invested capital of the company. Explain if and why shareholder value has been created from the acquisition when...
-
Several creditors had extended the money because of their reliance on the erroneous financial statements if Brew Construction should fail to pay them? Explain. What action if any the creditors can...
-
The Dunder Mifflin Company has total assets of $153,389,547, current liabilities of $59,678,443, and long-term liabilities of $72,574,739. The firm has 4,777,362 shares of common stock outstanding....
-
Which of the following is FALSE regarding the purchasing power parity (PPP). a. The PPP is a manifestation of the law of one price b. The PPP says that a country with a higher expected inflation can...
-
While preparing Massie Miller's 2012 Schedule A, you review the following list of possible charitable deductions provided by Massie: Cash contribution to a family whose house burned...
-
Cypress Corporation has regular taxable income of $170,000 (assume annual gross receipts are greater than $5 million) and regular tax liability of $49,550 for 2012. The corporation also has tax...
-
Indicate, in each of the following situations, the number of exemptions the taxpayers are entitled to claim on their 2012 income tax returns. Number of Exemptions a. Donna, a 20-year-old single...
-
For the streams listed in Table 7.9 (cyclohexane process) and Table 7.13 (HDA process), specify (or select) a pressure (or temperature), and calculate temperature (or pressure). Indicate the reasons...
-
Convert the process flowsheet in Figure 7.22 into a flowsheet for mass-balance simulation Task-1. List the model equations, the variables to be specified, and the variables to be calculated. Figure...
-
Given the feed streams and the parameters of the process units as shown in Figure 7.39, complete the simulation flowsheet for ASPEN PLUS and show the calculation sequence (i.e., complete the...
Study smarter with the SolutionInn App