Re: HACKED [mv] eWeek using Minivend in our openhack project

["Barry Treahy, Jr." <Treahy@mmaz.com>]

******    message to minivend-users from "Barry Treahy, Jr." <Treahy@mmaz.com>     ******

I haven't tested this on MV 4, but on MV 3, I cannot reproduce it.  Anyone else?

Barry


> ... minivend file view_page.html:
>
> ---cut here---
> [elsif session arg =~ /^\/|\.\./]
> ---cut here---
>
> does no proper input validation checks (they forgot about the "|" :)
>
> these two problems do allow http-request like:
>
> https://www.openhack.com/cgi-bin/eweekorcl/view_page.html?mv_arg=|ls|
>

-
To unsubscribe from the list, DO NOT REPLY to this message.  Instead, send
email with 'UNSUBSCRIBE minivend-users' in the body to Majordomo@minivend.com.
Archive of past messages: http://www.minivend.com/minivend/minivend-list