CVE-2020-14412 | BDVDB-2026-138207 Detail

Description#

NeDi 1.9C is vulnerable to Remote Command Execution. System-Snapshot.php improperly escapes shell metacharacters from a POST request. An attacker can exploit this by crafting an arbitrary payload (any system commands) that contains shell metacharacters via a POST request with a psw parameter. (This can also be exploited via CSRF.)

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12020-06-29Record published in the CVE List.
2. Version 22024-08-04Most recent update recorded in the CVE List.