Santa Clara, Calif. - May 10, 2000 - Perfecto Technologies, the leading developer of Web application security management software, today released its latest Black Watch Labs advisory that reveals how the Form Mail script allows several environment variables to be viewed by the attacker, who can gain useful information on the site, making further attacks more feasible. FormMail contains a debug field named "env_report", whose value is a list of environment variables (accessed via $ENV[name]) separated by commas. These variables (if they exist) are embedded into the message body. Furthermore, the script does not check the integrity of the recipient, thus the recipient field can be changed, so the message will be sent to the attacker's account. Thus the attacker can gain the environment information. For more information go to https://www.perfectotech.com/blackwatch/.

About Black Watch Labs (www.perfectotech.com/blackwatch/)
Black Watch Labs is a research group operated by Perfecto Technologies Inc., the leader in Web Application Security Management. Black Watch Labs was established in order to further the knowledge of the Internet community in the arena of Web application security management. Black Watch Labs publishes security advisories regularly, which are maintained at https://www.perfectotech.com/blackwatch/, and are also posted to relevant security lists and Web sites. Black Watch Labs also operates a Web application security mailing list, which can be subscribed to at https://www.perfectotech.com/blackwatch/. For more info about Black Watch Labs and Web Application Security Management, please call (408) 352-2000 or email [email protected].

About Perfecto Technologies
Founded in 1997 and headquartered in Santa Clara, Calif., Perfecto Technologies is the leader in Web Application Security Management software. AppShield, Perfecto Technologies flagship product, is the first to provide extreme security for customer-facing applications in dynamic Web site environments. Perfecto Technologies has customers in many sectors including, banking, e-tailing, finance, government and healthcare. Privately held, Perfecto Technologies is funded by blue-chip venture capital firms and industry leaders, including Sequoia Capital, Walden and Intel Corporation. More information about Perfecto Technologies may be obtained by visiting the Company's Web site at www.perfectotech.com or by calling the Company directly at (408) 352-2000.

For Immediate Release
Contact:

Kevin Pedraja
Sterling Communications
(408) 441-4100
[email protected]