Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is sitting in my web site's cgi-bin. Should I be concerned about it?


print <<HTML;
Content-type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<meta http-equiv="Content-Type" content="text/html">
<link rel="stylesheet" type="text/css" href="../../css/style.css">
<table cellspacing="0" cellpadding="0" border="0">
<tr class="subhead" align="Left"><th>Name</th><th>Value</th></tr>

my $class;

foreach (sort keys %ENV) {
    next unless /^HTTP_|^REQUEST_/;
    $class = ($class ne 'normal')? 'normal': 'alt';
    print <<HTML;
<tr class="$class"><td valign="top">$_</td><td>$ENV{$_}</td></tr>

print <<HTML;
share|improve this question
up vote 9 down vote accepted

It looks like it goes through and makes an HTML table out of all of your environmental variables.

Would you consider that nefarious? I'd consider anything that I didn't put on my own server to be nefarious, but that's me.

share|improve this answer

Looking at the code, it appears to be decidedly naive (it would be possible to use it to leverage an attack) however it doesn't appear to have been written for that purpose.

However if the code is on your website and you don't know why / how it got there nor what function it serves, then you shouldn't even have to ask us before removing it!

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.