CVE-2024-3955 Arbitrary code execution in CraftBeerPi 4

URL GET parameter "logtime" utilized within the "downloadlog" function from "cbpi/httpendpoints/httpsystem.py" is subsequently passed to the "os.system" function in "cbpi/controller/systemcontroller.py" without prior validation allowing to execute arbitrary code.This issue affects CraftBeerPi 4:...

CVE-2024-3955

The CraftBeerPi 4 software is vulnerable to arbitrary code execution due to a lack of input validation. The application's downloadlog function in cbpi/http_endpoints/http_system.py takes the "logtime" URL GET parameter and passes it directly to the os.system function in cbpi/controller/system_con...