جزئیات آسیب‌پذیری

CGI versions before 5.00 for Perl allow HTML injection via text containing --> in comment. Arguments are placed between <!-- and --> without escaping, so text containing --> closes the comment early. An application that passes request data to comment can be made to inject HTML into the page.

• https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm technical-description
• https://metacpan.org/release/LEEJO/CGI-5.00/changes release-notes
• https://github.com/leejo/CGI.pm/commit/6a17eb84703d84bca86b0079f5870ca9c921ffd4.patch patch