Description (CNA)
thesystem 1.0 contains a command injection vulnerability that allows unauthenticated attackers to execute arbitrary system commands by submitting malicious input to the run_command endpoint. Attackers can send POST requests with shell commands in the command parameter to execute arbitrary code on the server without authentication.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| kostasmitroglou / thesystem | affected 1.0 |
CWE
CWE-78
References
- https://www.exploit-db.com/exploits/47441
- https://github.com/kostasmitroglou/thesystem
- https://www.vulncheck.com/advisories/thesystem-command-injection-via-runcommand-endpoint
ADP enrichment
No English description supplied.
No references supplied.