| शीर्षक | Sangfor Operation and Maintenance Management System (OSM / 运维安全管理系统) 3.0.8 OS Command Injection |
|---|
| विवरण | A critical Remote Command Execution (RCE) vulnerability exists in the Sangfor Operation and Maintenance Security Management System (OSM) version 3.0.8. The vulnerability is located in the endpoint /isomp-protocol/protocol/session.
The application fails to properly sanitize user input in the HTTP POST request parameters when handling the SSH protocol. Code analysis reveals that the backend retrieves the keypassword parameter and directly concatenates it into a shell command string (specifically an ssh-keygen command). This string is subsequently executed by the system shell. |
|---|
| स्रोत | ⚠️ https://github.com/LX-LX88/cve/issues/20 |
|---|
| उपयोगकर्ता | LINXI666 (UID 91556) |
|---|
| सबमिशन | 10/01/2026 04:08 AM (9 महीनों पहले) |
|---|
| संयम | 22/01/2026 08:40 AM (12 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 342300 [Sangfor Operation and Maintenance Management System तक 3.0.12 SSH Protocol session SessionController keypassword अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|