[OT] Re: login cgi argument sanity checking

[Sacha Mallais <sacha@xxxxxxxxxxxxxxxxxx>]

On Aug 23, 2005, at 11:38 AM, Cory Snavely wrote:
> (I will occasionally see strings like "|cat /etc/passwd" passed as  
> a CGI argument to web applications we run, and thoroughly roll my  
> eyes at such pathetic attempts, but it goes to show that some folks  
> will try an exploit in any conceivable place.)

Not as pathetic as you might think.  The Daily WTF (http:// 
www.thedailywtf.com/) is filled with code from deployed systems that  
have such ridiculous holes.  A recent, somewhat relevant post: http:// 
www.thedailywtf.com/forums/41153/ShowPost.aspx

Sorry for the only tangentially-related post,


sacha


--
Sacha Michel Mallais - 800 lb. gorilla
Global Village Consulting Inc.:   http://www.global-village.net/
            1. Never tell everything at once.
            -- Ken Venturi, Ken Venturi's Two Great Rules of Life