Actions
Bug #5874
closedstatus_rrd_graph_img.php: Lack of validation on "graph" variable can lead to shell exec
Start date:
02/10/2016
Due date:
% Done:
100%
Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
All
Affected Architecture:
All
Description
The graph parameter on status_rrd_graph_img.php is somewhat sanitized but still allows the pipe character, which can be used to craft a command that will be executed.
Easiest demo is with some bunk data such as:
And then look in the system log for "foo".
Happens on 2.2.x and 2.3. I have a fix in mind, will push it once it's tested on both 2.2.x and 2.3.
Updated by Jim Pingle over 8 years ago
- Status changed from Assigned to Feedback
- % Done changed from 0 to 100
Applied in changeset 6a109e3eafe6849d7907d59a3395329aaf5c12c9.
Updated by Jim Pingle over 8 years ago
Applied in changeset 7cd2add4de7b85f64033722a055d72f379e487ca.
Updated by Jim Pingle over 8 years ago
- Status changed from Feedback to Resolved
Feedback from the original reporter confirms it is now fixed.
Actions