| शीर्षक | DefaultFuction Notice System Managent V2.0 Code Injection |
|---|
| विवरण | The /execute endpoint in the NoticeController of the Notice System uses GroovyShell.evaluate() to directly execute user-supplied code parameters without any sanitization. Attackers can submit specially crafted Groovy expressions (e.g., "cmd /c whoami".execute().text) via this interface, leveraging the dynamic execution features of the Groovy script engine to bypass system permission controls, thereby achieving remote code execution and gaining full control over the server. This can lead to severe consequences including data breaches and complete system compromise. It is strongly recommended to immediately disable this endpoint or implement strict whitelist-based input validation.
|
|---|
| स्रोत | ⚠️ https://github.com/DefaultFuction/Notice-System-Managent/issues/1 |
|---|
| उपयोगकर्ता | Practice (UID 95611) |
|---|
| सबमिशन | 28/06/2026 05:05 PM (2 महीनों पहले) |
|---|
| संयम | 15/08/2026 02:05 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 390703 [DefaultFuction Notice-System-Managent 2.0 NoticeController /execute GroovyShell.evaluate अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|