Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Narcissus backend.php Image Configuration Command Injection
Vulnerability Description
Narcissus is vulnerable to remote code execution via improper input handling in its image configuration workflow. Specifically, the backend.php script fails to sanitize the release parameter before passing it to the configure_image() function. This function invokes PHP’s passthru() with the unsanitized input, allowing attackers to inject arbitrary system commands. Exploitation occurs via a crafted POST request, resulting in command execution under the web server’s context.
CVSS Information
N/A
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Vulnerability Title
Narcissus 安全漏洞
Vulnerability Description
narcissus是The Angstrom Distribution开源的一个在线图像组装器。 Narcissus存在安全漏洞，该漏洞源于未清理release参数，可能导致远程命令执行。
CVSS Information
N/A
Vulnerability Type
N/A