| शीर्षक | Qualitor Qualitor Web 8.20/8.24 Code Injection |
|---|
| विवरण | Critical Code Injection vulnerability in Qualitor Web version 8.20/8.20 BD 206. The file /html/st/stdeslocamento/request/getResumo.php uses the eval() function execute the content of the passageiros parameter received via $_REQUEST without proper validation. Despite the presence of a sanitizeEval() function, the sanitization is insufficient to prevent code injection.
This vulnerability allows unauthenticated attackers to inject arbitrary PHP code that will be executed directly on the server. Through this injection, attackers can escalate to Remote Code Execution (RCE) using functions such as system(), exec(), passthru(), or shell_exec(), enabling the execution of operating system commands, establishment of reverse shells, unauthorized access and modification of sensitive data including configuration files and databases, lateral movement within the network, and potentially complete compromise of the affected server. |
|---|
| स्रोत | ⚠️ https://www.youtube.com/watch?v=hU8YbFc6KpI |
|---|
| उपयोगकर्ता | mtzsec (UID 52162) |
|---|
| सबमिशन | 07/11/2025 08:19 PM (11 महीनों पहले) |
|---|
| संयम | 29/11/2025 09:36 PM (22 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 333796 [Qualitor तक 8.20.104/8.24.97 getResumo.php eval passageiros अधिकार वृद्धि] |
|---|
| अंक | 17 |
|---|