Re: htaccess with apache

[Tim Greer <chatmaster () charter net>]

On Tue, 2003-11-04 at 11:38, A.D.Douma wrote:
> Hello,
>
> I had a similair problem with a cgi script that used a <input type='hidden'
> name='success' value=succes.'html'> to point the clients browser to the
> "transaction complete page".
>
> Because of this an attacker could read every file on the webserver. Luckily
> the /etc/passwd file was shadowed. My question is what else could an
> attacker do? Would command execution be possible?
>
> Thanks

Command execution is unlikely, but other vulnerabilities may exist in
your script.  Sometimes read access is all an attacker needs. 
Ultimately, if the script isn't checking the file type, the path, or
having more secure checking going on, you shouldn't use it until or
unless it's remedied or replaced.  To protect a script from these type
of things is very simple, with little knowledge--otherwise try the
services of a qualified programmer to assist you.
-- 
Tim Greer <chatmaster () charter net>