CWE-78 on ZAP

OS Command Injection - Unix cat /etc/passwd (pipe)

Mon, 01 Jan 0001 00:00:00 +0000

OS command injection (also known as shell injection) is a web security vulnerability that allows an attacker to execute arbitrary operating system (OS) commands on the server that is running an application, and typically fully compromise the application and all its data.

Generated by OWASP PTK DAST Module

Remote Code Execution - Shell Shock

Mon, 01 Jan 0001 00:00:00 +0000

The server is running a version of the Bash shell that allows remote attackers to execute arbitrary code.

Remote Code Execution - Shell Shock

Mon, 01 Jan 0001 00:00:00 +0000

The server is running a version of the Bash shell that allows remote attackers to execute arbitrary code.

Remote Code Execution (React2Shell)

Mon, 01 Jan 0001 00:00:00 +0000

The server is running Next.js and vulnerable versions of React Server Components with Next.js which allow remote attackers to execute arbitrary code.

Remote OS Command Injection

Mon, 01 Jan 0001 00:00:00 +0000

Attack technique used for unauthorized execution of operating system commands. This attack is possible when an application accepts untrusted input to build operating system commands in an insecure manner involving improper data sanitization, and/or improper calling of external programs.

Remote OS Command Injection (Time Based)

Mon, 01 Jan 0001 00:00:00 +0000

Spring4Shell

Mon, 01 Jan 0001 00:00:00 +0000

The application appears to be vulnerable to CVE-2022-22965 (otherwise known as Spring4Shell) - remote code execution (RCE) via data binding.