Re: Technical Details of Urlcount.cgi Vulnerability

[Tom Hanlin <tom () powerbasic com>]

In-Reply-To: <000501c226a1$c0f58060$e62d1c41 () kc rr com>

> When I informed Summit Computer Networks' Scott
> Slater about the Urlcount.cgi vulnerability, he replied to
> me that the application was property of PowerBASIC,
> and that he would forward it on.  Hearing nothing from
> either Slater, or PowerBASIC, Inc. in nearly two
> weeks, and in response to requests for information from
> list readers, I have decided to make details of the
> vulnerability public.

I gather it never occurred to you to contact PowerBASIC or even to follow up with Mr. Slater. Thank you so much. If I 
hadn't run across this case on an unrelated web search, PowerBASIC might never have heard of the problem.

Urlcount.cgi was based on the PowerBASIC sample program, EZCount, which is purely introductory in nature: "hello, 
world!"-type code, not designed or intended for practical use. But, it's a perfectly good idea to put safety first, and 
we'll have an update out shortly.