module
Vinchin Backup and Recovery Command Injection
| Disclosed |
|---|
| Oct 26, 2023 |
Disclosed
Oct 26, 2023
Description
This module exploits a command injection vulnerability in Vinchin Backup & Recovery
v5.0.*, v6.0.*, v6.7.*, and v7.0.*. Due to insufficient input validation in the
checkIpExists API endpoint, an attacker can execute arbitrary commands as the
web server user.
v5.0.*, v6.0.*, v6.7.*, and v7.0.*. Due to insufficient input validation in the
checkIpExists API endpoint, an attacker can execute arbitrary commands as the
web server user.
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.