Ncilengir

Roxy-WI is a Web interface for managing HAProxy, Nginx, and Keepalived servers. The system command can be run remotely via the `subprocess execute` function without processing the inputs received from the user in the `/app/options.py` file.

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. The issue arises from the `subprocess execute` function in the `/app/options.py` file, which does not properly process user input, allowing system commands to be executed remotely without authentication. This enables attackers to run arbitrary code on the system.

A vulnerability in Roxy-wi allows a remote, unauthenticated attacker to bypass authentication and access admin functionality by sending a specially crafted HTTP request. This issue affects Roxy-wi, an open source web interface for managing Haproxy, Nginx, Apache, and Keepalived servers.

A vulnerability in Roxy-wi allows a remote, unauthenticated attacker to achieve code execution by sending a specially crafted HTTP request to the "/app/options.py" file. This issue is related to the incorrect neutralization of special elements in output, which can be exploited by a remote attacker to execute arbitrary code.

The issue affects GLPI instances with the native inventory used, potentially leaking sensitive information due to a lack of authentication in the feature to get refused files.