3 ms·
Do you usually try $UserInput $Userinput $userInput $user_input etc. when you do that? It couldn't run your code if it had an uninitialized variable in it, rig
by bgilroy26 14y ago
Do you usually try $UserInput $Userinput $userInput $user_input etc. when you do that?
It couldn't run your code if it had an uninitialized variable in it, right?
- jkn 14y agoIt's vulnerable because the user controls the content of $userinput, the variable name doesn't matter. Real code would look like this: #!/usr/bin/perl print "Enter filename: "; $filename = <STDIN>; open(file_handler, "$filename"); If you see this code, you know that you can execute any command by giving it at the filename prompt and appending a '|' character. For example giving cat /etc/passwd |zenity --text-info | will popup a dialog with the content of /etc/passwd.
- bgilroy26 14y agoOh I see, I thought you were talking about something that would be caught by the interpreter if you put use strict; and use warnings; in there. Thank you for taking the time to put in an example, I understand you better now.