News for hackers. Stuff that matters.
Re:No one expects command execution by yk on Friday July 03, 2015 @01:20PM (#9826775)
This way around is perfectly obvious. But assume that you are writing a website that prints a man page, for example by piping the output of man $URLPARAMETER to the user. In that case it is only obvious to check if man can execute arbitrary commands if you already know that man is not just a cat for man pages.

There are no comments on this comment yet.