critical9.8
CVE-2019-25441
thesystem 1.0 contains a command injection vulnerability that allows unauthenticated attackers to execute arbitrary system commands by submitting malicious inp…
Impact
thesystem 1.0 contains a command injection vulnerability that allows unauthenticated attackers to execute arbitrary system commands by submitting malicious input to the run_command endpoint. Attackers can send POST requests with shell commands in the command parameter to execute arbitrary code on the server without authentication.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Kostasmitroglou | Thesystem | Version 1.0.0 |