I have tried to explain this to my boss but as I have not yet proven my perl skills (which are somewhat limited) and this is not what I was employed for anyway, they were more than a little hesitant to listen to me.

This is not a Perl question. It's general secure programming practice; whether the CGI program is written in Perl, C, Lisp, bash or any other language wouldn't matter here, the issue at heart is that it was written to trust user input.

Explain to your boss that the problem is really serious. Ask them if they would agree to be given a demonstration. Cover your back at every step of the road in case you are unjustly reproached at a later date: get written confirmations whenever possible and try to always have a coworker come along to meetings. Do not go ahead and just make a demonstration. If necessary, offer to do so in spare, unpaid time. If you are given the go-ahead, make several demonstrations: the boss may lack the technical understanding to deduce how far reaching the problem really is if you only make a single one. Come up with serious attacks; deface the site, fiddle with /etc/passwd etc; whatever comes to mind. Make sure, obviously, to back up the altered files prior to the demonstration. If you are refused the chance to explain, at least make sure you can prove you did what could be expected of you so that if any damage happens, the responsibility is with those who dismissed your concerns.

Good luck.

Makeshifts last the longest.

In reply to Re: The danger of hidden fields by Aristotle
in thread The danger of hidden fields by Gerard

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.