Falhas do tipo CWE-78
4.566 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2024-7470MEDIUMRaisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface vpn_template_style.php sslvpn_config_mod os command injectionEPSS 24.9%CVE-2024-7468MEDIUMRaisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list_service_manage.php sslvpn_config_mod os command injectionEPSS 24.9%CVE-2024-7469MEDIUMRaisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list_vpn_web_custom.php sslvpn_config_mod os command injectionEPSS 24.9%CVE-2012-5863—Sinapsi eSolar OS Command InjectionEPSS 24.8%CVE-2022-36309—Airspan AirVelocity 1500 software versions prior to 15.18.00.2511 have a root command injection vulnerability in the ActiveBank parameter ofEPSS 24.6%CVE-2021-3708—D-Link router DSL-2750U with firmware vME1.16 or prior versions is vulnerable to OS command injection. An unauthenticated attacker on the loEPSS 24.6%CVE-2018-19949CRITICALIf exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue EPSS 24.4%KEVCVE-2022-32572CRITICALAn os command injection vulnerability exists in the aVideoEncoder wget functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A sEPSS 24.4%CVE-2023-51123CRITICALAn issue discovered in D-Link dir815 v.1.01SSb08.bin allows a remote attacker to execute arbitrary code via a crafted POST request to the seEPSS 24.4%CVE-2024-46658HIGHSyrotech SY-GOPON-8OLT-L3 v1.6.0_240629 was discovered to contain an authenticated command injection vulnerability.EPSS 24.4%CVE-2024-4884CRITICALWhatsUp Gold CommunityController Unrestricted File Upload Remote Code Execution VulnerabilityEPSS 24.3%CVE-2025-34227HIGHNagios XI < 2026R1 Configuration Wizard Authenticated Command InjectionEPSS 24.3%CVE-2023-32150MEDIUMD-Link DIR-2640 PrefixLen Command Injection Remote Code Execution VulnerabilityEPSS 23.7%CVE-2024-7467MEDIUMRaisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list_ip_network.php sslvpn_config_mod os command injectionEPSS 23.4%CVE-2024-5411HIGHCommand InjectionEPSS 23.4%CVE-2023-32153MEDIUMD-Link DIR-2640 EmailFrom Command Injection Remote Code Execution VulnerabilityEPSS 23.4%CVE-2024-9977MEDIUMMitraStar GPT-2541GNAC Firewall Settings Page settings-firewall.cgi os command injectionEPSS 22.9%CVE-2023-27076CRITICALCommand injection vulnerability found in Tenda G103 v.1.0.0.5 allows attacker to execute arbitrary code via a the language parameter.EPSS 22.9%CVE-2025-43984CRITICALAn issue was discovered on KuWFi GC111 devices (Hardware Version: CPE-LM321_V3.2, Software Version: GC111-GL-LM321_V3.0_20191211). They are EPSS 22.9%CVE-2025-15472HIGHTRENDnet TEW-811DRU httpd uapply.cgi setDeviceURL os command injectionEPSS 22.6%