| शीर्षक | https://gitee.com/opencc/JFlow JFlow latest version Remote Code Execution |
|---|
| विवरण | Jflow is a widely used open-source/commercial workflow management system. In the source code of its latest version, the Calculate() method (around lines 5775-5779) in the file src/main/java/bp/wf/httphandler/WF_CCForm.java contains a critical Remote Code Execution (RCE) vulnerability.
When processing dynamic calculation logic for form fields, this method fails to strictly filter or validate user-inputted formulas or parameters. Attackers can craft malicious HTTP requests to inject specific operating system command separators (such as |, &, ;, $(), etc.) into the calculation interface, causing the backend server to execute arbitrary system commands without authorization. Successful exploitation of this vulnerability allows attackers to obtain the highest server privileges (e.g., root/system), thereby enabling them to steal sensitive data, implant backdoors, tamper with business data, or cause service outages. |
|---|
| स्रोत | ⚠️ https://gitee.com/opencc/JFlow/issues/IE8R2F?from=project-issue |
|---|
| उपयोगकर्ता | MaoQiu (UID 94327) |
|---|
| सबमिशन | 27/02/2026 12:24 PM (8 महीनों पहले) |
|---|
| संयम | 08/03/2026 05:31 PM (9 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 349779 [opencc JFlow तक 5badc00db382d7cb82dad231e6a866b18e0addfe WF_CCForm.java Calculate अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|