Re: shell script cgi

[Philip Rowlands <phr () doc ic ac uk>]

On Thu, 14 Nov 2002, c jones wrote:

> I have found the line below in an sh cgi program, and believe I can
> pass a command to the shell but can't seem to get it to work right.
[snip]
> ua=`echo "$HTTP_USER_AGENT" | sed "s#\;##g"`

The quotes around HTTP_USER_AGENT prevent any "chained commands", e.g.
'Mozilla 6; rm -rf /'.

Perhaps you're confusing the backticks; they execute the line given in
the script, not the result of the 'echo ...; sed'.

I don't see any way here to manipulate the input to execute arbitrary
code.


Cheers,

Phil