PocketVJ CP Remote Code Execution Vulnerability in submit_size.php Component

A remote code execution vulnerability has been identified in PocketVJ CP version 3.9.1. The issue arises in the submit_size.php component, which improperly sanitizes input before executing commands via shell_exec(), exec(), and system(). This flaw allows remote attackers to inject arbitrary commands through HTTP POST requests, potentially leading to a full compromise of the host system.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server, with the executed commands running in the same context as the web server user. This could lead to a complete takeover of the affected system.