CVE-2020-14412

NeDi 1.9C is vulnerable to Remote Command Execution. System-Snapshot.php improperly escapes shell metacharacters from a POST request. An attacker can exploit this by crafting an arbitrary payload any system commands that contains shell metacharacters via a POST request with a psw parameter. This...

CVE-2020-14412

CVE-2020-14412 affects NeDi 1.9C. The System-Snapshot.php file fails to properly escape shell metacharacters from POST requests, enabling potential Remote Command Execution via a crafted payload in the psw parameter; CSRF also noted as a possibility. Documents confirm the vulnerability vector and...