mirror of
https://github.com/gobysec/GobyVuls.git
synced 2025-05-28 17:20:48 +00:00
540 B
540 B
Sahi Pro v8.x RCE (CVE-2019-13597)
_s_/sprm/_s_/dyn/Player_setScriptFile in Sahi Pro 8.0.0 allows command execution. It allows one to run .sah scripts via Sahi Launcher. Also, one can create a new script with an editor. It is possible to execute commands on the server using the _execute() function.
FOFA query rule: body="s/spr/" || "sahisid" || title="Sahi Launcher"
Demo
