/ 
CGI-Simple-0.080
River stage three • 25 direct dependents • 813 total dependents
/ CGI::Simple::Util
Security Advisories (4)
CVE-2010-4410 (2010-12-27)

Newlines in headers, which could lead to header injection attacks.

CPANSA-CGI-Simple-2010-01 (2010-12-27)

Non-random multipart boundary.

CVE-2010-2761 (2010-12-06)

The multipart_init function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier uses a hardcoded value of the MIME boundary string in multipart/x-mixed-replace content, which allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input that contains this value, a different vulnerability than CVE-2010-3172.

CVE-2025-40927 (2025-08-29)

CGI::Simple versions before 1.282 for Perl has a HTTP response splitting flaw This vulnerability is a confirmed HTTP response splitting flaw in CGI::Simple that allows HTTP response header injection, which can be used for reflected XSS or open redirect under certain conditions. Although some validation exists, it can be bypassed using URL-encoded values, allowing an attacker to inject untrusted content into the response via query parameters. As a result, an attacker can inject a line break (e.g. %0A) into the parameter value, causing the server to split the HTTP response and inject arbitrary headers or even an HTML/JavaScript body, leading to reflected cross-site scripting (XSS), open redirect or other attacks. The issue documented in CVE-2010-4410 https://www.cve.org/CVERecord?id=CVE-2010-4410 is related but the fix was incomplete. Impact By injecting %0A (newline) into a query string parameter, an attacker can: * Break the current HTTP header * Inject a new header or entire body * Deliver a script payload that is reflected in the server’s response That can lead to the following attacks: * reflected XSS * open redirect * cache poisoning * header manipulation

NAME

CGI::Util - Internal utilities used by CGI::Simple module

SYNOPSIS

$escaped     = escapeHTML('In HTML you need to escape < > " and & chars');
$unescaped   = unescapeHTML('&lt;&gt;&quot;&amp;');
$url_encoded = escape($string);
$decoded     = unescape($url_encoded);

DESCRIPTION

CGI::Simple::Util contains essentially non public subroutines used by CGI::Simple. There are HTML and URL escape and unescape routines that may be of some use.

An internal object is used to store a number of system specific details to enable the escape routines to be accurate.

AUTHOR INFORMATION

Original version copyright 1995-1998, Lincoln D. Stein. All rights reserved.

This version copyright 2001, Dr James Freeman.

This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

Address bug reports and comments to: jfreeman@tassie.net.au

SEE ALSO

CGI::Simple