Hzmanyun Education and Training System Command Injection Vulnerability Leading to Remote Code Execution

A critical command injection vulnerability has been identified in version 2.1 of the Hzmanyun Education and Training System. The issue arises in the 'exportPDF' function within the '/user/exportPDF' endpoint, where improper handling of the 'id' parameter allows for the injection of arbitrary commands. This vulnerability can be exploited remotely, potentially leading to unauthorized command execution on the server.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the server, with the potential for a complete system compromise.

Reproduction

To reproduce this vulnerability, send a request to the '/user/exportPDF' endpoint with a crafted 'id' parameter that includes injected commands. The server will execute the injected commands due to the command injection vulnerability, leading to unauthorized command execution.