| tiêu đề | https://github.com/Jrohy https://github.com/Jrohy/trojan v2.15.3 Command Injection |
|---|
| Mô tả | There is a critical command injection (Remote Code Execution, RCE) vulnerability in the /trojan/log endpoint of the jrohy-trojan web interface. The issue arises because user input from the line query parameter is concatenated directly into a shell command without proper sanitization. As a result, remote attackers can inject arbitrary shell commands, leading to full command execution on the server with the privileges of the web service. This allows attackers to compromise the server, steal sensitive data, or further escalate their attack. No authentication is required for exploitation due to CVE-2024-55215, making the vulnerability even more dangerous. |
|---|
| Nguồn | ⚠️ https://github.com/Tritium0041/Jrohy-trojan-RCE-POC |
|---|
| Người dùng | Tritium (UID 50779) |
|---|
| Đệ trình | 29/05/2025 10:30 (cách đây 1 Năm) |
|---|
| Kiểm duyệt | 03/06/2025 14:50 (5 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 310966 [Jrohy trojan đến 2.15.3 trojan/util/linux.go LogChan c nâng cao đặc quyền] |
|---|
| điểm | 20 |
|---|