next »

[repman]

Hi,

My ISP found a security hole in the script which allowed some person to drop a file in my web directory. Any one know how I can fix this? The server is running BSD

thanks,
Bill

----------------------------------
Here's the message from the the ISP SysAdmin:

However, this hack did not involve anyone knowing your password.  It was done by exploiting a security hole in your /cgi-bin/calendar/calendar.pl CGI script.  

<<Actual commands were deleted from view to avoid any duplication from other would be hackers>>

Obviously the script uses the value of the "fromTemplate" form variable as a filename without validating it first.  This is very dangerous because it is an open door into your account.  You should either remove the script,
or modify it to test the validity of all form data instead of trusting it implicitly.

[This message has been edited by repman (edited July 14, 2004).]

[DanO]

** Any one know how I can fix this? **

Yes, upgrade to the current version. That is why it was released.

PS. It might be wise to delete the actual hack instructions from your previous message. No use giving idle hands an opportunity to try it out on some other unsuspecting user?

Dan O.
the Unofficial CalendarScript - Mods and Plugins site

------------------