[cobalt-users] Security implications of a custom cgi script in the admin Gui

["Steve Bassi" <steve@xxxxxxxxx>]

I have added the scipt below to /usr/admserv/cgi-bin/.cobalt/admin.

This allows me to enter bash commands from a web interface.

I access the page from
https://www.domain.com:81/cgi-bin/.cobalt/admin/scriptname
so my admin password goes over ssl.

Would anyone be able to tell me any additional security implications this
could have?

And any suggestions to enhance the security of using what seems to be a
potentially dangerous script.

Thanks

Bassi


#!/usr/bin/perl
   print "Content-type: text/html\n\n";
   if ( $ENV{'CONTENT_LENGTH'} ) {
       read(STDIN,$_,$ENV{'CONTENT_LENGTH'});
       s/(.)*=//; s/\+/ /g; s/%(..)/pack("c",hex($1))/ge;
       $out=`$_ 2>&1`;
       print "\%: $_<PRE>$out</PRE>";
   }
   print "<FORM METHOD=POST>
          <INPUT TYPE=\"TEXT\" NAME=\"text\" SIZE=60 MAXLENGTH=100>
          <INPUT TYPE=\"SUBMIT\" VALUE=\"Ok\"></FORM>";