CVE-2018-13338

System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "username" parameter during user creation.

Score

CVSS 3.0 9.8 Critical

Status

Modified - cve@mitre.org

Published

2018-11-27

Last modified

2024-08-05

Weaknesses

CWE-78

Affected products

• Terramaster Operating System (Terra-master)

References

• https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a