irix-infosrch.cgi.txt

`Hi,  
  
InfoSearch is a web-based interface to books, manpages, and relnotes,  
distributed by SGI.  
  
No suprises here, no parsing is done on the 'fname' variable before being  
passed to man2html. (i.e. when cmd is 'getdoc' and db is 'man').  
  
Also, fname is the _full path_ to the manpage/relnote! I'm sure there's  
more vulnerabilities lurking about in this script.  
  
Example:  
http://my.really.expensive.sgi.box/cgi-bin/infosrch.cgi?cmd=getdoc&db=man&fname=|/bin/id  
  
Thanks,  
--jared <[email protected]> || <[email protected]>  
Security Specialist -- Internet Arena  
  
  
`