| タイトル | Sangfor Operation and Maintenance Security Management System (OSM / 运维安全管理系统) v3.0.12 Command Injectiona |
|---|
| 説明 | A critical Remote Command Execution (RCE) vulnerability exists in the Sangfor Operation and Maintenance Security Management System (OSM). The vulnerability is located in the endpoint /fort/audit/get_clip_img.
The application fails to properly sanitize user input in the HTTP POST request parameters when handling clipboard image retrieval. Code analysis reveals that the backend retrieves the frame and dirno parameters and directly concatenates them into a shell command string. This string is subsequently executed by the system shell via ShellExecutor. This interface is accessible without authentication (No Auth). |
|---|
| ソース | ⚠️ https://github.com/LX-LX88/cve/issues/22 |
|---|
| ユーザー | hhsw34 (UID 91076) |
|---|
| 送信 | 2026年01月12日 10:29 (9 月 ago) |
|---|
| モデレーション | 2026年01月25日 10:50 (13 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 342801 [Sangfor Operation and Maintenance Security Management System HTTP POST Request /fort/audit/get_clip_img 特権昇格] |
|---|
| ポイント | 20 |
|---|