Argument Injection in GitHub repository froxlor/froxlor prior to 2.0.0-beta1.
The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Link | Tags |
---|---|
https://huntr.dev/bounties/b7140709-8f84-4f19-9463-78669fa2175b | third party advisory exploit |
https://github.com/froxlor/froxlor/commit/f2485ecd9aab8da544b5e12891d82ae6fcff5fc7 | third party advisory patch |