CGI textfield injection

[cmic]

Hi folks
Some guys are polluting my Perl Wiki Site (UseMod based). I think they are injecting porn/spam page thru the address line. To make this injection impossible, I must know how these pranksters operate; Could someone complete the following line to inject code into a CGI.pm Perl site? (The page is in a CGI texfield form) Imean, where on the line should I put the text (ex: "injected Spam Text bla bla") to inject ?

http://www.xyy.abc.fr/index.pl?action=edit&id=NewPage

PS: I promise, it's *not* to destroy other sites !!

[Tanalis]

I could, but I won't. While your intentions might be honourable enough, there's no guarantee that the next person who reads this thread will have the same innocuous intentions.

You can almost certainly set up suitable logging via your web server to trap the request that's being made that's causing the malicious content to be injected. That should allow you to figure out how to simulate the request, and hence help you close the hole.

Sorry to not be more help.

Update: Yet another grammatical fix.

[cmic]

Hello Foxclub. I do agree with your explanations. I'm gonna find a way to test a similar idea and get the client/server messages to guess what happens. I understand it could be dangerous to publish such code here.

[Your Mother]

I'd consider helping you as I think hackable software is often only fixed by confrontation. As a show of good faith, would you tell us what's the URI of your Wiki?

[cmic]

Hi YourMother
OK, ok. But as a show of good faith, I won't show my (actually vulnerable) site adress here, of course. If only I had you e-mail... Write me here (no obligation of course) and I'll tell you the whole stuff:
cmic <at> caramail <dot> com