IPCop <= 2.1.9 Authenticated RCE

IPCop versions up to and including 2.1.9 contain an authenticated remote code execution vulnerability within the web-based administration interface. The email configuration component inserts user-controlled values, including the EMAIL_PW parameter, directly into system-level operations without proper input sanitation. By modifying the email password field to include shell metacharacters and issuing a save-and-test-mail action, an authenticated attacker can execute arbitrary operating system commands with the privileges of the web interface, resulting in full system compromise.

N/A

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

IPCop 安全漏洞

IPCop是IPCop开源的一个防火墙软件。 IPCop 2.1.9及之前版本存在安全漏洞，该漏洞源于电子邮件配置组件未正确清理用户输入，可能导致远程代码执行。

N/A

N/A