CVE-2024-53992

unzip-bot is a Telegram bot to extract various types of archives. Users could exploit unsanitized inputs to inject malicious commands that are executed through subprocess.Popen with shell=True. Attackers can exploit this vulnerability using a crafted archive name, password, or video name. This...

CVE-2024-53992 unzip-bot Allows Remote Code Execution (RCE) via archive extraction, password prompt, or video upload

unzip-bot is a Telegram bot to extract various types of archives. Users could exploit unsanitized inputs to inject malicious commands that are executed through subprocess.Popen with shell=True. Attackers can exploit this vulnerability using a crafted archive name, password, or video name. This...

CVE-2024-53992

CVE-2024-53992 affects unzip-bot, a Telegram bot that extracts archives. The vulnerability arises from unsanitized inputs (archive name, password, or video name) that can be crafted to trigger command execution via subprocess.Popen with shell=True. Documented impact includes potential remote code...

CVE-2024-53992 unzip-bot Allows Remote Code Execution (RCE) via archive extraction, password prompt, or video upload

unzip-bot is a Telegram bot to extract various types of archives. Users could exploit unsanitized inputs to inject malicious commands that are executed through subprocess.Popen with shell=True. Attackers can exploit this vulnerability using a crafted archive name, password, or video name. This...

unzip-bot 操作系统命令注入漏洞

unzip-bot is a Telegram bot used by EDM115 to extract various types of archives. An operating system command injection vulnerability exists in versions prior to unzip-bot 7.0.3a, which stems from improper input cleanup and allows a user to inject malicious commands via constructed zip file names,...

PT-2024-36004 · Unzip-Bot · Unzip-Bot

Name of the Vulnerable Software and Affected Versions: unzip-bot versions prior to 7.0.3a Description: The issue allows users to exploit unsanitized inputs to inject malicious commands that are executed through subprocess.Popen with shell=True. Attackers can exploit this using a crafted archive...