Re: shell script cgi

On Thu, 14 Nov 2002, c jones wrote:

>I have found the line below in an sh cgi program, and believe I can
>pass a command to the shell but can't seem to get it to work right.
[snip]
>ua=`echo "$HTTP_USER_AGENT" | sed "s#\;##g"`

The quotes around HTTP_USER_AGENT prevent any "chained commands", e.g.
'Mozilla 6; rm -rf /'.

Perhaps you're confusing the backticks; they execute the line given in
the script, not the result of the 'echo ...; sed'.

I don't see any way here to manipulate the input to execute arbitrary
code.

Cheers,

Phil
Received on Nov 16 2002