cat "$filename"
...
Oh dear. Ohdearohdearohdear.
Now all we need to do is make sure that the first character in $filename is "&" followed by some privilege escalation exploit and ...
(Am I missing something?)
...
Oh dear. Ohdearohdearohdear.
Now all we need to do is make sure that the first character in $filename is "&" followed by some privilege escalation exploit and ...
(Am I missing something?)
% foo="& do_evil"
% cat "$foo"
cat: & do_evil: No such file or directory
edit: and with the CGI stuff it might be possible to execute rm or something else dangerous/destructive.
echo none:`date`
echo double: "`date`"
echo single: '`date`'