poll_it.txt

`The CGI is available from:  
  
http://www.cgi-world.com/pollit.html  
  
The bug takes place when calling the CGI and passing it parameters that  
overwrite settings initialized in the CGI:  
  
/cgi-bin/pollit/Poll_It_SSI_v2.0.cgi?data_dir=/etc/passwd%00  
  
Because the CGI initializes it's internal variables before parsing any form  
data, and the method it uses to parse form data overwrites internal variables  
(in this case, $data_dir), it is possible to retrieve any files readable by the  
webserver.  
  
On line 78 is the line:  
  
%in = &ReadForm;  
  
Moving it above the local variable initializations to line 66, causes any  
internally used variables to be initialized after the query is processed,  
therefore insuring that correct data is used for the form.  
  
This doesn't appear to change the usability of the CGI, and from what I can  
determine, doesn't create any other security concerns (although of this fact I  
am not 100% certain).  
  
--  
Adrian Daminato  
Tucows International Corp.  
http://www.tucows.com  
Tel: (416) 535-0123  
Fax: (416) 531-5584  
  
`