Hack Security Pro.pdf - Index of

A CGI can also fall victim to a stack overflow. If we come back to the code part given as an example at
the beginning of this chapter, we can see that the buffer whose role it is to receive the chain of
characters passed on to the program is limited to 49 characters. So, if more characters than is
possible are passed on to one of the variables, a segmentation error is likely to happen during the
execution of the CGI, in which case a stack overflow is to be feared.
Finally, as has been said earlier on, CGIs are likely to interpret arguments that are sent to it without
these being of the value1=value&... type, and that is of course the case for some of them.
Let us take the example of the php.cgi CGI:
The Hackademy DMP -120/209- SYSDREAM