Falhas do tipo CWE-78
5.059 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2023-34127HIGHImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SonicWall GMS, SonicWall AnalytiEPSS 85.8%CVE-2018-6961HIGHVMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component. This coEPSS 85.5%KEVCVE-2020-26217HIGHRemote Code Execution in XStreamEPSS 85.0%CVE-2024-20328MEDIUMClamAV VirusEvent File Processing Command Injection VulnerabilityEPSS 84.8%CVE-2022-24697CRITICALApache Kylin prior to 4.0.2 allows command injection when the configuration overwrites function overwrites system parametersEPSS 84.8%CVE-2023-39362HIGHAuthenticated command injection in SNMP options of a DeviceEPSS 84.8%CVE-2023-4542MEDIUMD-Link DAR-8000-10 sys1.php os command injectionEPSS 84.7%CVE-2025-64328HIGHFreePBX Administration GUI is Vulnerable to Authenticated Command InjectionEPSS 84.6%KEVCVE-2020-15415CRITICALOn DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution vEPSS 84.5%KEVCVE-2020-12641CRITICALrcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setEPSS 84.4%KEVCVE-2024-12856HIGHFour-Faith Industrial Router adjust_sys_time OS Command InjectionEPSS 84.3%CVE-2025-34152CRITICALShenzhen Aitemi M300 Wi-Fi Repeater OS Command Injection via Time ParameterEPSS 83.8%CVE-2021-27561CRITICALYealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authenticatiEPSS 83.6%KEVCVE-2024-10915CRITICALD-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injectionEPSS 83.2%CVE-2024-9464CRITICALExpedition: Authenticated OS Command Injection Vulnerability Leads to Firewall Admin Credential DisclosureEPSS 82.6%CVE-2022-1292CRITICALThe c_rehash script allows command injectionEPSS 82.6%CVE-2020-26259MEDIUMXStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshallingEPSS 82.4%CVE-2023-27992CRITICALThe pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versEPSS 82.3%KEVCVE-2023-30253HIGHDolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instead of <?php in injectEPSS 82.1%CVE-2023-1698CRITICALWAGO: WBM Command Injection in multiple productsEPSS 81.9%