mailing list archives
CGI-City's CCLOG Script Injection Vulns
From: "BrainRawt ." <brainrawt () hotmail com>
Date: Sat, 29 Mar 2003 18:46:07 +0000
CGI-City's CCLOG USER-AGENT and REFERER Script Injection
Vulnerabilities Discovered By BrainRawt (brainrawt () hotmail com)
CC Log is a very simple logging script which logs the hits to
a single web page. This script is typically useful for logging
the hits to the main index page. It collects information like
date and time of the hit, browser agent used by the visitor,
host IP addresses, and HTTP referrer whenever available. The
script logs everything on to an HTML log file which the user
can easily view under any browser. This script requires SSI.
CCLOG can be downloaded from the following address.
1-30-03 Emailed cgicity () icthus net
CCLOG's cc_log.pl lacks filtering of any data coming in from the
remote host. This data in return is redirected to an html. Due
to the lack of input filters, a malicious visitor could inject
scripting into that html by falsifying the USER-AGENT and/or the
REFERER. This attack would result in the execution of the
injected script by anyones browser that views the html.
Add photos to your messages with MSN 8. Get 2 months FREE*.
- CGI-City's CCLOG Script Injection Vulns BrainRawt . (Mar 29)