Re: Security bug in CGI::Lite::escape_dangerous_chars() function

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



> Better would be...
>

<snip>

And better still would be no command execution at all:

use Net::SMTP;

my $email = <<EOM;
To: $to
From: $from
Subject: $subject

...
...
EOM

my $smtp = Net::SMTP->new("mailsever.host.com");
$smtp->mail($from);
$smtp->to($to);
$smtp->data();
$smtp->datasend($email);
$smtp->dataend();
$smtp->quit();

...No command execution at all, and no need to have the issue-prone 
sendmail binary even installed on the system.

John




-- 
# John Madden  weez@freelists.org
# MailandFiles.com: Your mail, your files: http://www.mailandfiles.com
# FreeLists: Free mailing lists for all: http://www.freelists.org
# Linux, Apache, Perl and C: All the best things in life are free!


[Index of Archives]     [Linux Security]     [Netfilter]     [PHP]     [Yosemite News]     [Linux Kernel]

  Powered by Linux