Chapter 4 - Vulnerable CGI Scripts

Abstract

Common Gateway Interface (CGI) programs can be a great benefit or a great burden, depending on whether one is protected against possible vulnerabilities that can be used to hack their site. CGI programs and scripts run on the server side, and act as an intermediary between the Web server and an external application. They are used on numerous sites on the Web, and for a variety of purposes. In terms of e-commerce sites, they are essential to the method in which business is conducted, and many sites cannot function without them. Break-ins resulting from weak CGI scripts can occur in a variety of ways. This may be through gaining access to the source code of the script and finding vulnerabilities contained in it, or by viewing information showing directory structure, usernames, and/or passwords. By manipulating these scripts, a hacker can modify or view sensitive data, or even shut down a server so users are unable to use the site. In most cases, the cause of a poor CGI script can be traced back to the person who wrote the program. However, by following good coding practices, one can avoid such problems and will be able to use CGI programs without compromising the security of the site.