제출 #779174: elecV2 <=3.8.3 Remote Code Execution정보

제목elecV2 <=3.8.3 Remote Code Execution
설명The /rpc endpoint requires no authentication. The pm2run method concatenates params[0] directly into exec('pm2 start ' + params[0]) without sanitization, enabling OS command injection. Confirmed by reading /etc/passwd from the response.
원천⚠️ https://github.com/elecV2/elecV2P/issues/196
사용자
 ZAST.AI (UID 87884)
제출2026. 03. 13. AM 05:28 (6 개월 ago)
모더레이션2026. 03. 27. PM 03:11 (14 days later)
상태수락
VulDB 항목353897 [elecV2 elecV2P 까지 3.8.3 /rpc pm2run 권한 상승]
포인트들17

◂ 이전개요다음 ▸

Interested in the pricing of exploits?

See the underground prices here!