如果参数包含等号，CGI 脚本不会接收参数

发布于 2024-11-24 02:37:04 字数 1234 浏览 5 评论 0原文

我有一个 CGI 脚本（编译的 C 程序），它输出其命令行参数（argv[0]、argv[1] 等）。

如果我尝试 http://ajf.me/c/?abc 我会得到“abc”作为第二个参数。

但是，如果我尝试 http://ajf.me/c/?a=bc 我不获取任何第二个参数。

为什么使用 = 会阻止参数传递给程序？

如果重要的话，这里是 C 代码：

#include <stdio.h>

int main (int argc, char *argv[]) {
    int i;
    printf("Content-Type: text/html;charset=utf-8\n\n");
    printf("<!DOCTYPE html>\n");
    printf("<html>\n");
    printf("<head>\n");
    printf("<title>ajf.me powered by ANSI C!</title>\n");
    printf("</head>\n");
    printf("<body>\n");
    printf("<h2>Supplied Arguments</h2>\n");
    printf("argc: %d\n", argc);
    printf("<ol>\n");
    for (i = 0; i < argc; ++i) {
        printf("<li>%s</li>\n", argv[i]);
    }
    printf("</ol>\n");
    printf("<em>Yes, this is vulnerable to null-byte injection. For instance, <a href=\"?Injected%%00Null\" style=\"font-family: monospace; color: green;\">?Injected\\0Null</a>.</em>\n");
    printf("</body>\n");
    printf("</html>\n");
}

原文

I have a CGI script (compiled C program) that outputs its command line arguments (argv[0], argv[1] etc.).

If I try http://ajf.me/c/?abc I get "abc" as the second parameter.

However, if I try http://ajf.me/c/?a=bc I do not get any second parameter.

Why does using = stop the parameters from being passed to the program?

If it matters here is the C code:

#include <stdio.h>

int main (int argc, char *argv[]) {
    int i;
    printf("Content-Type: text/html;charset=utf-8\n\n");
    printf("<!DOCTYPE html>\n");
    printf("<html>\n");
    printf("<head>\n");
    printf("<title>ajf.me powered by ANSI C!</title>\n");
    printf("</head>\n");
    printf("<body>\n");
    printf("<h2>Supplied Arguments</h2>\n");
    printf("argc: %d\n", argc);
    printf("<ol>\n");
    for (i = 0; i < argc; ++i) {
        printf("<li>%s</li>\n", argv[i]);
    }
    printf("</ol>\n");
    printf("<em>Yes, this is vulnerable to null-byte injection. For instance, <a href=\"?Injected%%00Null\" style=\"font-family: monospace; color: green;\">?Injected\\0Null</a>.</em>\n");
    printf("</body>\n");
    printf("</html>\n");
}

分享到QQ

分享到微博