Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitymedium

[0day-rubbish] core-admin 1.0.164 (build 16468) Systemic shell command injection via ineffective quote escaping (8.8)

Full Disclosure ()2
Read at seclists.org
AI summary · glm-5.3-flashSummaries by Vani AI

0day Rubbish discloses a CVSS 8.8 shell command injection in core-admin 1.0.164 via ineffective quote escaping, enabling authenticated remote code execution.

0day Rubbish Research Team publicly disclosed a systemic shell command injection (CWE-78) in core-admin 1.0.164 (build 16468). The flaw stems from ineffective quote escaping and scores 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The disclosure does not mention a CVE identifier or observed exploitation in the wild.

Key facts
  • Shell command injection via ineffective quote escaping (CWE-78) in core-admin 1.0.164 build 16468
  • CVSS 8.8 network vector requiring low privileges with no user interaction
  • Publicly disclosed as a 0day; no patch or exploitation details given
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
command-injectioncore-admincwe-78disclosure

From the original article

Posted by disclosure via Fulldisclosure on Sep 08 TO: fulldisclosure () seclists org SUBJECT: [0day-rubbish] core-admin 1. 0. 164 (build 16468) Systemic shell command injection via ineffective quote escaping (8.

Full Disclosure

seclists.org

Read the full article at Full Disclosure

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.