New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Shell injection from admin password #16

Open

davispw opened this issue Aug 5, 2024 · 1 comment

davispw commented Aug 5, 2024

jcgroup/src/main/java/me/haosdent/cgroup/util/Shell.java

Line 29 in 8d6f291

sb.append(admin.getPassword());

Friends don't let friends exec unquoted strings…while running sudo no less…

Author

davispw commented Aug 5, 2024

More…this code is rife with shell injections

jcgroup/src/main/java/me/haosdent/cgroup/util/Constants.java

Line 7 in 8d6f291

public static final String SHELL_MKDIR = "mkdir -p %s";

Please, delete this before someone gets hurt.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment