Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Webgrind 1.1 - Remote Command Execution (RCE) via dataFile Parameter
Vulnerability Description
Webgrind 1.1 contains a remote command execution vulnerability that allows unauthenticated attackers to inject OS commands via the dataFile parameter in index.php. Attackers can execute arbitrary system commands by manipulating the dataFile parameter, such as using payload '0%27%26calc.exe%26%27' to execute commands on the target system.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Vulnerability Title
Webgrind 操作系统命令注入漏洞
Vulnerability Description
Webgrind是Joakim Nygård个人开发者的一款基于Web的PHP性能分析工具。 Webgrind 1.1版本存在操作系统命令注入漏洞，该漏洞源于index.php中的dataFile参数未经验证，可能导致未经身份验证的攻击者注入操作系统命令。
CVSS Information
N/A
Vulnerability Type
N/A