Matt Wright: >> Matt Wright Guestbook >> 2.3 Security Vulnerabilities
guestbook.pl cleanses user-inserted SSI commands by removing text between "<!--" and "-->" separators, which allows remote attackers to execute arbitrary commands when guestbook.pl is run on Apache 1.3.9 and possibly other versions, since Apache allows other closing sequences besides "-->".
CVSS Score
7.5
EPSS Score
0.88
Published
1999-09-13