Re: Command injection with no spaces

[Robin Wood <robin () digininja org>]

On 14 June 2012 10:18, Matt Summers <matt () fireantsecurity co uk> wrote:
> Folks,
>
> We came across an interesting bug in a web system where we could execute any
> system command (on AIX) but we could not enter any spaces in the command and
> we would only get the last line of STDOUT.
>
> Has anyone else come across anything like this?
>
> The most we were able to do was cat the last line from system files and
> determine if a directory existed.
>
> Cheers,

Have you tried using tabs instead of spaces?

Robin

> Matt
>
> --- Part time worker full time salary ---
> _______________________________________________
> Pauldotcom mailing list
> Pauldotcom () mail pauldotcom com
> http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom
> Main Web Site: http://pauldotcom.com
_______________________________________________
Pauldotcom mailing list
Pauldotcom () mail pauldotcom com
http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom
Main Web Site: http://pauldotcom.com