[0day-rubbish] IPConfigure Orchid VMS 26.3.0 authenticated DNF repository GPG-key property command injection to root (7.2)
IPConfigure Orchid VMS 26.3.0 allows authenticated command injection through a DNF GPG-key property to root.
The 0day Rubbish Research Team disclosed an authenticated operating-system command injection in IPConfigure Orchid VMS, installed as Orchid Recorder, version 26.3.0. The server property package.dnf.repo.gpg_key, which holds the URL or path of the GPG key for the vendor RPM repository, is written without character validation. The issue is described as CWE-78 and CWE-20, with CWE-250 on the resulting root privileges, and is scored 7.2. No CVE or observed exploitation is stated.
- Authenticated OS command injection (CWE-78) in Orchid Recorder 26.3.0.
- package.dnf.repo.gpg_key accepts an unsanitized GPG-key URL or path.
- Injection yields root; disclosure scores the issue 7.2.
- Published by 0day Rubbish Research Team; no CVE named.
- Vendors
- IPConfigure
- Products
- Orchid VMSOrchid Recorder
- Organizations
- 0day Rubbish Research Team
From the original article
Posted by disclosure via Fulldisclosure on Oct 06 0day Rubbish Research Team is publicly disclosing a vulnerability in IPConfigure Orchid VMS, installed as Orchid Recorder, version 26. 3. 0.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.