Command Injection - CRITICISM

How it was found

Description: The $openssl code in curl 8.17.0.1 allows exploitation.

Steps to reproduce:

1. Extract and install curl on Windows.
2. See the code in mk-ca-bundle.

Affected: curl:8.17.0.1 SO:Windows 11/10/8

Helped analized: Deep Seek

perl $result = "$openssl" dgst -r -sha256 "$_[0]";

Problem: The $_[0] parameter is directly interpolated into the shell command.

Risk: Attack can execute arbitrary commands.

Example of exploitation: perl sha256("file.txt; rm -rf /") sha256("file.txt; cat /etc/passwd")

Best, @tomar-re

Impact

Extraction of confidential information.