Description (CNA)
ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the selected media path is merely surrounded with single quotes; embedded single quotes are not escaped.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| CellHubs / ExifTool for photo and video | affected 5.0.1-gms |
CWE
CWE-78
References
- https://fluidattacks.com/advisories/saturn
- https://play.google.com/store/apps/details?id=com.exiftool.free
ADP enrichment
No English description supplied.
No references supplied.