webshell exists in the project

[EBWi11]

https://github.com/moses-smt/mosesdecoder/blob/master/contrib/iSenWeb/trans_result.php

poc: input1=;ls

[jzySaber1996]

CWE-ID: CWE-78 (OS Command Injection)
Assigned to CVE-2023-6309

[zentery]

There is a patch for this issue, for example, add:
$value = escapeshellarg($value);

[hieuhoang]

Is this ok? 9a3d385 If not please send a PR.

…

On Wed, Jan 15, 2025, 11:53 PM zmy ***@***.***> wrote: There is a patch for this issue, for example, add: $value = escapeshellarg($value); — Reply to this email directly, view it on GitHub <#237 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAFI4FCBGRLOB2MZCCWAZLD2K5QN3AVCNFSM6AAAAABOGTZHF2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDKOJUG42TENZZGQ> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>