Wp2Fac OS Command Injection Vulnerability

A command injection vulnerability has been identified in Wp2Fac version 1.0, specifically within the send.php endpoint. This vulnerability allows remote attackers to execute arbitrary system commands by injecting shell commands through the 'numara' parameter. The exploitation involves appending commands with '&' operators to execute malicious code on the server.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the server where Wp2Fac is installed.

Reproduction

To reproduce this vulnerability, send a POST request to the send.php endpoint with the 'numara' parameter. Include the desired shell command, appended with '&' operators, to execute the command on the server. The response will indicate whether the command execution was successful.