CVE-2018-13330

System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands during group creation via the "groupname" parameter.

Score

CVSS 3.0 7.2 High

Status

Modified - cve@mitre.org

Published

2018-11-27

Last modified

2024-08-05

Weaknesses

CWE-78

Affected products

• Terramaster Operating System (Terra-master)

References

• https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a