Description
This script is vulnerable to code execution attacks.
Code injection vulnerabilities occur where the output or content served from a Web application can be manipulated in such a way that it triggers server-side code execution. In some poorly written Web applications that allow users to modify server-side files (such as by posting to a message board or guestbook) it is sometimes possible to inject code in the scripting language of the application itself.
Remediation
Your script should filter metacharacters from user input.
References
Related Vulnerabilities
WordPress Plugin VaultPress Remote Code Execution (1.9.0)
WordPress Cookie Data PHP Code Injection Vulnerability (1.5 - 1.5.1.3)
Apache Tomcat Remote Code Execution Vulnerability
VMware Aria Operations for Networks RCE (CVE-2023-20887)
WordPress Plugin Wp-FileManager 'ajaxfilemanager.php' Arbitrary File Upload (1.2)