CGI Lite Perl Module Metacharacter Input Validation Vulnerability

Bugtraq ID:	6833
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 11 2003 12:00AM
Updated:	Feb 11 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to "Ronald F. Guilmette" <[email protected]>.
Vulnerable:	Benjamin Low CGI-Lite 2.0
Not Vulnerable:

CGI Lite Perl Module Metacharacter Input Validation Vulnerability

A vulnerability has been reported in the escape_dangerous_chars() function, which is a part of the CGI Lite Perl module. The function does not sufficiently sanitize all instances of potentially dangerous characters. As the end result, externally supplied input may not be adequately sanitized before being used in other Perl functions. This will create a false sense of security and may allow an attacker to execute arbitrary commands via a CGI program which depends on the vulnerable function.

CGI Lite Perl Module Metacharacter Input Validation Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

CGI Lite Perl Module Metacharacter Input Validation Vulnerability

References:

• CGI Lite 2.0 Home Page (Benjamin Low)
  
• Security bug in CGI::Lite::escape_dangerous_chars() function ("Ronald F. Guilmette" )