Description (CNA)
Tea LaTex 1.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary shell commands through the /api.php endpoint. Attackers can craft a malicious LaTeX payload with shell commands that are executed when processed by the application's tex2png API action.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| ammarfaizi2 / Tea LaTex | affected 1.0 |
CWE
CWE-78
References
- https://www.exploit-db.com/exploits/48805
- https://github.com/ammarfaizi2/latex.teainside.org
- https://www.vulncheck.com/advisories/tea-latex-remote-code-execution
ADP enrichment
No English description supplied.