Adam Outikni

**Name of the Vulnerable Software and Affected Versions** Vitec Flamingo version 4.12.2 **Description** An unauthenticated OS command injection exists due to a double-evaluation flaw in shell argument handling. The 'admin/ajax/ping.php' endpoint processes the `host` POST parameter using the `escapeshellarg()` function before passing it to a system wrapper. However, the wrapper retrieves the decoded value from `argv` and passes it into a second `shell exec()` call without further escaping. This allows remote attackers to execute arbitrary commands with root privileges via passwordless sudo. **Recommendations** Update Vitec Flamingo version 4.12.2 to a patched version. As a temporary workaround, restrict access to the 'admin/ajax/ping.php' endpoint or avoid using the `host` parameter in that endpoint.

**Name of the Vulnerable Software and Affected Versions** Vitec Flamingo version 4.12.2 **Description** An unauthenticated OS command injection exists in the 'admin/ajax/gen graphs.php' endpoint. Remote attackers can execute arbitrary commands with root privileges by providing shell metacharacters through the `start`, `end`, `key`, or `format` HTTP GET parameters. This occurs because the graph generation script fails to sanitize input before passing it to shell commands via the `passthru()` function. The ability to gain root privileges is facilitated by the web server context having passwordless sudo access. **Recommendations** For version 4.12.2, apply the available security patch immediately. As a temporary mitigation, restrict access to the 'admin/ajax/gen graphs.php' endpoint or avoid using the `start`, `end`, `key`, and `format` parameters until the patch is applied.