[FD] [Full Disclosure] CVE-2024-22900: Unpatched Command Injection in Vinchin Backup and Recovery Versions 7.2 and Earlier

[Balgogan via Fulldisclosure <fulldisclosure@xxxxxxxxxxxx>]

CVE ID: CVE-2024-22900

Title: Command Injection Vulnerability in Vinchin Backup and Recovery Versions 
7.2 and Earlier

Description:
A critical security vulnerability, identified as CVE-2024-22900, has been 
discovered in Vinchin Backup and Recovery software, affecting versions 7.2 and 
earlier. The vulnerability is present in the `setNetworkCardInfo` function, 
which is intended to update network card information.

Details:
1. The function collects the `NAME` parameter from the user request and assigns 
it to a variable `$name`.
2. The `NAME` parameter value is then used to construct a file path in the 
`setNetworkCardInfo` function, leading to potential command injection.
3. The vulnerability arises from the use of user-supplied input in system 
commands without proper validation and sanitization.

Impact:
This vulnerability allows an attacker to inject arbitrary commands via the 
`NAME` parameter, potentially leading to unauthorized access or control over 
the affected system.

Current Status:
As of the current date, there is no known patch available for this 
vulnerability. Users of Vinchin Backup and Recovery versions 7.2 and earlier 
are at risk.

Recommendation:
It is strongly recommended that users of the affected software versions remain 
vigilant and monitor Vinchin's updates for a security patch. Upon release of a 
patch, users should prioritize updating their systems to mitigate this security 
risk.

Signed,Valentin Lobstein
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/