Gerard has asked for the wisdom of the Perl Monks concerning the following question:
Good Afternoon all,
My current employer, with whom I have not been very long, and I only work here part time while continuing to study, has a script on our site which seems to have a security flaw.
All the scripts that the company uses were written several years ago by a programmer who no longer works here.
These scripts are used daily, but are not ever needed to be changed because they were written in such a way that hidden fields in the html form will be submitted and then the script will determine what to do. Therefore all the current employees need to concern themselves with is designing pretty looking web pages etc. and then just including the appropiate hidden fields.
This has been like this for several years and working relatively smoothly. It was not until another employee weas having trouble with her hidden fields that I chanced to look at this particular script. What I found concerned me a little.
All the customer data that is submitted to the script is as well as being emailed to us, stored in a text file. However the text file to store the data in is passed as a hidden field from the html, and there is no check to make sure that the referring page is the correct one.
My concern is that someone could submit their own html form and change the value for where it is to be saved (all the hidden fields are quite obviously named) and at least cause havoc, if not serious damage.
Is this a reasonable concern?
I have tried to explain this to my boss but as I have not yet proven my perl skills (which are somewhat limited) and this is not what I was employed for anyway, they were more than a little hesitant to listen to me.
My perl work experience is somewhat limited and so I cannot perhaps explain the risk as well as some of you with more experience.
What I am asking is if anyone has any comments that I could make to my employer, or include in a short report so that I will be allowed to fix this potential problem, that would be much appreciated.
Or if you think I am just over reacting, then let me know.
Much appreciated.
Regards,
Gerard O'Brien
All the scripts that the company uses were written several years ago by a programmer who no longer works here.
These scripts are used daily, but are not ever needed to be changed because they were written in such a way that hidden fields in the html form will be submitted and then the script will determine what to do. Therefore all the current employees need to concern themselves with is designing pretty looking web pages etc. and then just including the appropiate hidden fields.
This has been like this for several years and working relatively smoothly. It was not until another employee weas having trouble with her hidden fields that I chanced to look at this particular script. What I found concerned me a little.
All the customer data that is submitted to the script is as well as being emailed to us, stored in a text file. However the text file to store the data in is passed as a hidden field from the html, and there is no check to make sure that the referring page is the correct one.
My concern is that someone could submit their own html form and change the value for where it is to be saved (all the hidden fields are quite obviously named) and at least cause havoc, if not serious damage.
Is this a reasonable concern?
I have tried to explain this to my boss but as I have not yet proven my perl skills (which are somewhat limited) and this is not what I was employed for anyway, they were more than a little hesitant to listen to me.
My perl work experience is somewhat limited and so I cannot perhaps explain the risk as well as some of you with more experience.
What I am asking is if anyone has any comments that I could make to my employer, or include in a short report so that I will be allowed to fix this potential problem, that would be much appreciated.
Or if you think I am just over reacting, then let me know.
Much appreciated.
Regards,
Gerard O'Brien
Back to
Seekers of Perl Wisdom