Command Injection in sofianehamlaoui/lockdoor-framework

Valid
Reported on May 28th 2021

✍️ Description

Unsanitized user input leads to command injection in multiple scripts.

🕵️‍♂️ Proof of Concept

payload = ;id

https://drive.google.com/file/d/1ZPy_CaSyDbD2-gQK43DKlAHkFxi8lmgh/view?usp=sharing

💥 Impact

command run as root so it could do potential damage.

x3rz submitted a
a month ago
Jamie Slome
a month ago

Admin


For reference:

https://github.com/SofianeHamlaoui/Lockdoor-Framework/pull/17

I am manually marking as valid and will confirm the fix too.

Jamie Slome validated this vulnerability a month ago
x3rz has been awarded the disclosure bounty
$25
The fix bounty is now up for grabs
$6.25
Jamie Slome confirmed that a fix has been merged on 59e427 a month ago
x3rz has been awarded the fix bounty
$6.25