FSociety tool is an amazing tool to automatize some
pentesting tools like
Nmap in order to provide a
However, the commands are executed through the
python2 formatting system strings inserted inside the
os.system() function, which doesn't prevent the injection of new
options/arguments, but also of new
commands which aren't supposed to be executed.
Even if the tool isn't a module, so it's harder that it would be used inside a more complex system, it may comport some interesting issues like
RCE inside a website which could give access via a
web UI to the tool and return the
result of the tool.
It's not too difficult find website which do this and the unsanitized concatenation could lead to
arbitrary command injection.