Znuny Eval Injection Vulnerability Allowing Command Execution via Backup Script

An eval injection vulnerability has been identified in Znuny versions through 7.1.3. This issue allows a user with write access to the configuration file to execute commands as the user running the backup.pl script. In Znuny LTS, this vulnerability affects all versions from 6.5.1 up to 6.5.11 and all versions of Znuny LTS 6.0.

Impact

Exploitation of this vulnerability could lead to unauthorized command execution, potentially allowing privilege escalation if the backup script is run with root or another privileged account.