Command injection in ping
Closed this issue · 1 comments
PizzaWhisperer commented
After running make
, launch the server with ./bin/server
.
Then launch the client with ./bin/client 127.0.0.1 1337
and feed it with
ping stuff;xcalc
which pops a calc on the server side.
Indeed at this line https://github.com/yannvon/grass/blob/master/src/commands.cpp#L348 the user input is not escaped.