3 ms·
I don't understand. Are you agreeing with me or suggesting a string with the contents "curl" will somehow cause the server to execute the curl command?
by stephenr 9y ago
I don't understand. Are you agreeing with me or suggesting a string with the contents "curl" will somehow cause the server to execute the curl command?
- jessaustin 9y agoMaybe this was back in the days of CGI? It's perfectly feasible that the right combination of characters might break out of an ill-advised pipe to get to the shell.
- ams6110 9y agoYep, it might if it was ever passed to eval()
- intopieces 9y agoThis happened. I was working tech support for a company with a very old billing database. Customer was attempting to update his billing information with a new credit card and was immediately getting an error - Forbidden. Turned out it was his last name, Curl, that was causing the issue. The system was throwing an exception because it interpreted the customer's entry as attempting to execute the curl command. We ended up having him put "JR" at the end of his last name to prevent it.