MiniDVBLinux Remote Root Command Execution Vulnerability

A remote command execution vulnerability has been identified in MiniDVBLinux version 5.4. This vulnerability allows unauthenticated attackers to execute arbitrary commands as root by exploiting the 'command' GET parameter in the '/tpl/commands.sh' endpoint.

Impact

Exploitation of this vulnerability leads to unauthorized root-level access on the affected system.

Reproduction

The vulnerability can be reproduced by sending a GET request to the '/tpl/commands.sh' endpoint with the 'command' parameter set to a desired command. The command will be executed with root privileges, and the output can be retrieved from the response.