Product: PocketVJ CP
Affected Versions: pvj 3.9.1
Vulnerability Type: Remote Code Execution (RCE)
Description:
An issue in PocketVJ CP PocketVJ-CP-v3 pvj 3.9.1 allows remote attackers to execute arbitrary code via the submit_size.php component. The vulnerable code uses shell_exec(), exec(), and system() functions without proper sanitization.
Attack Vector:
PocketVJ CP PocketVJ-CP-v3 pvj version 3.9.1 contains a critical unauthenticated remote code execution vulnerability in the submit_opacity.php component. The application fails to sanitize user input in the opacityValue POST parameter before passing it to a shell command, allowing remote attackers to execute arbitrary commands with root privileges on the underlying system.
Vulnerability Type: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Products: PocketVJ CP (PocketVJ-CP-v3) versions 3.9.1 and earlier