dizqueTV Remote Code Execution Vulnerability

A remote code execution vulnerability exists in dizqueTV version 1.5.3. This issue allows attackers to inject arbitrary commands through the FFMPEG Executable Path settings. By exploiting inadequate input validation, attackers can alter the executable path to include shell commands that read system files, such as /etc/passwd.

Impact

Exploitation of this vulnerability allows for unauthorized remote code execution on the server where dizqueTV is running.

Reproduction

To reproduce this vulnerability, navigate to the FFMPEG Executable Path settings in dizqueTV 1.5.3. Inject a command, such as one that reads the /etc/passwd file, into the executable path. After updating the settings, the injected command will be executed, and the contents of the specified file will be displayed.