Thesystem Command Injection Vulnerability

A command injection vulnerability has been identified in Thesystem version 1.0. This vulnerability allows unauthenticated attackers to execute arbitrary system commands by sending malicious input to the run_command endpoint. Exploitation involves POST requests with shell commands included in the command parameter, enabling unauthorized code execution on the server.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the server where Thesystem is running.

Reproduction

To reproduce this vulnerability, send a POST request to the run_command endpoint without authentication. Include a command in the command parameter. The server will execute the command and return the output.