CVE-2023-54339
Webgrind 1.1 - Remote Command Execution (RCE) via dataFile Parameter
概要
Webgrind 1.1 - Remote Command Execution (RCE) via dataFile Parameter
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Webgrind 1.1 contains a remote command execution vulnerability that allows unauthenticated attackers to inject OS commands via the dataFile parameter in index.php. Attackers can execute arbitrary system commands by manipulating the dataFile parameter, such as using payload '0%27%26calc.exe%26%27' to execute commands on the target system.
参照URL
- advisory github.com
- advisory nvd.nist.gov
- advisory vulncheck.com
- report exploit-db.com
- web github.com