| शीर्षक | Sangfor Operation and Maintenance Management System (运维安全管理系统 / OSM) 3.0.8 Command Injection |
|---|
| विवरण | A Command Injection vulnerability exists in the Sangfor Operation and Maintenance Management System (OSM) version 3.0.8. The vulnerability is located in the endpoint within the class. The application fails to properly sanitize the parameter of the upload request. Specifically, the application uses an insufficient method that filters standard file system characters but fails to neutralize shell metacharacters (such as , , ). The malicious filename is then directly concatenated into a command execution string without parameterization. Remote attackers can exploit this vulnerability to execute arbitrary system commands with the privileges of the application (typically root or tomcat)./system/version/upload_CNVersionController.javafilenamemultipart/form-dataescape;|&bash |
|---|
| स्रोत | ⚠️ https://github.com/master-abc/cve/issues/10 |
|---|
| उपयोगकर्ता | junqi (UID 93773) |
|---|
| सबमिशन | 30/12/2025 05:26 PM (9 महीनों पहले) |
|---|
| संयम | 09/01/2026 06:12 PM (10 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 340344 [Sangfor Operation and Maintenance Management System तक 3.0.8 VersionController.java uploadCN filename अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|