Re: Technical Details of Urlcount.cgi Vulnerability
In-Reply-To: <000501c226a1$c0f58060$e62d1c41@xxxxxxxxx>
>When I informed Summit Computer Networks' Scott
>Slater about the Urlcount.cgi vulnerability, he replied to
>me that the application was property of PowerBASIC,
>and that he would forward it on. Hearing nothing from
>either Slater, or PowerBASIC, Inc. in nearly two
>weeks, and in response to requests for information from
>list readers, I have decided to make details of the
>vulnerability public.
I gather it never occurred to you to contact PowerBASIC or even to follow up
with Mr. Slater. Thank you so much. If I hadn't run across this case on an
unrelated web search, PowerBASIC might never have heard of the problem.
Urlcount.cgi was based on the PowerBASIC sample program, EZCount, which is
purely introductory in nature: "hello, world!"-type code, not designed or
intended for practical use. But, it's a perfectly good idea to put safety
first, and we'll have an update out shortly.