Operating System Command Injection
Critical Web Application Scanning Plugin ID 98123
SynopsisOperating System Command Injection
DescriptionOS command injection occurs when user supplied input is used to form a command
to be executed by the operating system.
Scanner was able to inject specific Operating System commands and have the output
from that command contained within the server response. This indicates that input
is not being sanitized properly.
SolutionIt is recommended that untrusted data is never used to form a command to be executed by the OS.
To validate data, the application should ensure that the supplied value contains only the characters that are required to perform the required action.