Description
This page is vulnerable to Argument Injection. A web application is vulnerable to argument injection when untrusted inputs are passed as arguments when executing a specific command. An attacker can manipulate the arguments passed to the process to trigger an OS command injection.
Remediation
Assume all input is malicious. Use a whitelist of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
References
Related Vulnerabilities
Drupal Core 8.x.x Remote Code Execution (8.0.0 - 8.3.8)
Horde Imp Unauthenticated Remote Command Execution
WordPress Plugin Advanced Access Manager Arbitrary Code Execution (2.8.2)
Drupal Core 9.3.x Remote Code Execution (9.3.0 - 9.3.18)
WordPress 2.0.2 Username Remote PHP Code Injection Vulnerability (0.6.2 - 2.0.2)