This is sitting in my web site's cgi-bin. Should I be concerned about it?


print <<HTML;
Content-type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<meta http-equiv="Content-Type" content="text/html">
<link rel="stylesheet" type="text/css" href="../../css/style.css">
<table cellspacing="0" cellpadding="0" border="0">
<tr class="subhead" align="Left"><th>Name</th><th>Value</th></tr>

my $class;

foreach (sort keys %ENV) {
    next unless /^HTTP_|^REQUEST_/;
    $class = ($class ne 'normal')? 'normal': 'alt';
    print <<HTML;
<tr class="$class"><td valign="top">$_</td><td>$ENV{$_}</td></tr>

print <<HTML;

It looks like it goes through and makes an HTML table out of all of your environmental variables.

Would you consider that nefarious? I'd consider anything that I didn't put on my own server to be nefarious, but that's me.


Looking at the code, it appears to be decidedly naive (it would be possible to use it to leverage an attack) however it doesn't appear to have been written for that purpose.

However if the code is on your website and you don't know why / how it got there nor what function it serves, then you shouldn't even have to ask us before removing it!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.