| शीर्षक | dst-admin dst-admin <= 1.5.0 Code Injection |
|---|
| विवरण | Multiple command injection vulnerabilities exist in dst-admin <= 1.5.0. The ShellService class contains several methods that construct shell commands by directly concatenating user-controlled input without any validation or sanitization. An attacker can inject arbitrary shell commands using command substitution syntax $() or backticks, which will be executed by /bin/sh -c before the main command runs. This can lead to complete server compromise, including arbitrary command execution and sensitive file access. |
|---|
| स्रोत | ⚠️ https://fx4tqqfvdw4.feishu.cn/docx/ObYgdtoweowo8Vx4dmuckqC7nBe?from=from_copylink |
|---|
| उपयोगकर्ता | xcxr (UID 86629) |
|---|
| सबमिशन | 09/02/2026 07:41 AM (8 महीनों पहले) |
|---|
| संयम | 22/02/2026 08:14 AM (13 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 347323 [qinming99 dst-admin तक 1.5.0 /home/restore revertBackup name अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|