PT-2026-21316 · Kostasmitroglou · Thesystem

Sadik Cetin · Publicado 2026-02-20 · Atualizado 2026-03-12 · CVE-2019-25441

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions thesystem version 1.0

Description The software contains a command injection issue that enables unauthenticated attackers to execute arbitrary system commands. Attackers can submit malicious input to the run command endpoint. Specifically, attackers can send POST requests with shell commands in the command parameter to execute arbitrary code on the server without authentication.

Recommendations Apply a fix to address the command injection issue in the run command endpoint. Restrict access to the run command endpoint. Sanitize or validate the command parameter to prevent the execution of arbitrary shell commands.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2019-25441

Produtos afetados

Thesystem

Referências · 6

• 🔥 https://exploit-db.com/exploits/47441 · Exploit
• https://github.com/kostasmitroglou/thesystem · Nota
• https://vulncheck.com/advisories/thesystem-command-injection-via-runcommand-endpoint · Nota
• https://osv.dev/vulnerability/CVE-2019-25441 · Aviso do Fabricante
• https://t.me/cveNotify/155308 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2019-25441 · Nota de Segurança