Falhas do tipo CWE-78
4.564 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2020-7351HIGHFonality Trixbox CE Post-Authentication Command InjectionEPSS 65.2%CVE-2021-27273HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System EPSS 65.0%CVE-2025-25256CRITICALAn improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in FortinEPSS 64.7%CVE-2024-4883CRITICALWhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution VulnerabilityEPSS 64.5%CVE-2022-44149HIGHThe web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by placing &telnetd inEPSS 64.4%CVE-2025-36604HIGHDell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command InjectionEPSS 64.1%CVE-2024-47407CRITICALmySCADA myPRO OS Command InjectionEPSS 64.0%CVE-2020-4428CRITICALIBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the systemEPSS 61.7%KEVCVE-2020-16205—Using a specially crafted URL command, a remote authenticated user can execute commands as root on the G-Cam and G-Code (Firmware Versions 1EPSS 61.1%CVE-2023-37928HIGHA post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 fiEPSS 60.2%CVE-2021-3577HIGHAn unauthenticated remote code execution vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attEPSS 60.2%CVE-2019-5485—NPM package gitlabhook version 0.0.17 is vulnerable to a Command Injection vulnerability. Arbitrary commands can be injected through the repEPSS 58.8%CVE-2024-0986MEDIUMIssabel PBX Asterisk-Cli os command injectionEPSS 58.2%CVE-2019-5029CRITICALAn exploitable command injection vulnerability exists in the Config editor of the Exhibitor Web UI versions 1.0.9 to 1.7.1. Arbitrary shell EPSS 57.1%CVE-2021-33554HIGHUDP Technology/Geutebrück camera devices: Command injection in appfile.filename parameter leading to RCEEPSS 57.0%CVE-2021-33548HIGHUDP Technology/Geutebrück camera devices: Command injection in preserve parameter leading to RCEEPSS 57.0%CVE-2021-33550HIGHUDP Technology/Geutebrück camera devices: Command injection in date parameter leading to RCEEPSS 57.0%CVE-2021-27104CRITICALAccellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed versEPSS 56.7%KEVCVE-2021-25297HIGHNagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/confiEPSS 56.7%KEVCVE-2013-3307HIGHLinksys E1000 devices through 2.1.02, E1200 devices before 2.0.05, and E3200 devices through 1.0.04 allow OS command injection via shell metEPSS 55.7%