Penetration Testing mailing list archives
Pass commande via URL with JSP
From: Cédric Foll <follc () insa-rouen fr>
Date: Sun, 15 Jul 2001 00:57:04 +0200
Hi, I'm working on the security of a web site. This on has got JSP page under broad vision. In one page, I can pass in paramater via the GET method a variable which the content is displayed on the page Ex: http://serveur/page.jsp?affich=<br><bold>bonjour</bold><br> It will be displayed "bonjour" in bold. Is it a flaw ???? Are thy flaws in JSP pages which can allow to execute arbitrary code in server side like there are in CGI script wrote in perl ???? Regards. -- Cédric Foll mail : cedric.foll () laposte net France ---------------------------------------------------------------------------- This list is provided by the SecurityFocus Security Intelligence Alert (SIA) Service For more information on SecurityFocus' SIA service which automatically alerts you to the latest security vulnerabilities please see: https://alerts.securityfocus.com/
Current thread:
- Pass commande via URL with JSP Cédric Foll (Jul 16)
- <Possible follow-ups>
- Re: Pass commande via URL with JSP Victor A. Rodriguez (Jul 16)