| शीर्षक | Sangfor Operation and Maintenance Security Management System (OSM / 运维安全管理系统) v3.0.12 Command Injectiona |
|---|
| विवरण | A critical Remote Command Execution (RCE) vulnerability exists in the Sangfor Operation and Maintenance Security Management System (OSM). The vulnerability is located in the endpoint /fort/audit/get_clip_img.
The application fails to properly sanitize user input in the HTTP POST request parameters when handling clipboard image retrieval. Code analysis reveals that the backend retrieves the frame and dirno parameters and directly concatenates them into a shell command string. This string is subsequently executed by the system shell via ShellExecutor. This interface is accessible without authentication (No Auth). |
|---|
| स्रोत | ⚠️ https://github.com/LX-LX88/cve/issues/22 |
|---|
| उपयोगकर्ता | hhsw34 (UID 91076) |
|---|
| सबमिशन | 12/01/2026 10:29 AM (9 महीनों पहले) |
|---|
| संयम | 25/01/2026 10:50 AM (13 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 342801 [Sangfor Operation and Maintenance Security Management System HTTP POST Request /fort/audit/get_clip_img अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|