maketorrent.php in TorrentFlux 2.2 allows remote authenticated users to execute arbitrary commands via shell metacharacters (; semicolon) in the announce parameter.
Affected Software
Name |
Vendor |
Start Version |
End Version |
Torrentflux |
Torrentflux |
2.2 (including) |
2.2 (including) |
References