| शीर्षक | php-censor <= 2.1.6 OS Command Injection |
|---|
| विवरण | PHP Censor (all versions through 2.1.6) allows unauthenticated OS command injection via the webhook endpoint. The WebhookController is whitelisted from authentication checks in Application.php, and the "branch" and "commit" parameters from GET/POST requests to /webhook/git/<projectId> are passed unsanitized through sprintf() into shell commands executed via Symfony Process::fromShellCommandline(). A remote unauthenticated attacker can inject arbitrary OS commands by sending a crafted branch parameter (e.g., ?branch=$(id)), which is executed asynchronously by the Worker process. In the default Docker deployment, commands run as root. |
|---|
| स्रोत | ⚠️ https://github.com/php-censor/php-censor/issues/442 |
|---|
| उपयोगकर्ता | anch0r (UID 96691) |
|---|
| सबमिशन | 11/05/2026 08:54 AM (5 महीनों पहले) |
|---|
| संयम | 31/05/2026 04:19 PM (20 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 367552 [php-censor तक 2.1.6 Webhook Endpoint GitBuild.php commitId अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|