| Package | Affected versions | Patched versions |
|---|---|---|
| nedi | = 1.9c |
NeDi 1.9C is vulnerable to Remote Command Execution. System-Snapshot.php improperly escapes shell metacharacters from a POST request. An attacker can exploit this by crafting an arbitrary payload (any system commands) that contains shell metacharacters via a POST request with a psw parameter. (This can also be exploited via CSRF.)
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free