Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
QSAN SANOS - Command Injection
Vulnerability Description
The QSAN SANOS setting page does not filter special parameters. Remote attackers can use this vulnerability to inject and execute arbitrary commands without permissions. The referred vulnerability has been solved with the updated version of QSAN SANOS v2.1.0.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Vulnerability Title
QSAN SANOS 操作系统命令注入漏洞
Vulnerability Description
QSAN SANOS是中国QSAN公司的SAN 存储管理操作系统。它配备了令人耳目一新的简单易用的 Web GUI，并且可以轻松部署到任何基础架构中。 QSAN SANOS 中存在操作系统命令注入漏洞，该漏洞源于该产品的setting页面未过滤用户输入的特殊字符。攻击者可通过该漏洞可在没有权限的情况下执行任意命令和注入恶意数据。以下产品及版本受到影响：QSAN SANOS 2.0.0 (build 202012222000) 版本及之前版本。
CVSS Information
N/A
Vulnerability Type
N/A