FTP-Flask-Python Command Injection Vulnerability

A command injection vulnerability exists in FTP-Flask-Python, specifically in the application's FTP management feature. The vulnerability allows unauthenticated remote attackers to execute arbitrary operating system commands. This issue arises because the 'Upload File' action on the '/ftp.html' endpoint constructs a shell command using the 'ftp_file' parameter and executes it with 'os.system()' without any proper input validation or sanitization.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the server where FTP-Flask-Python is running.

Reproduction

To reproduce this vulnerability, send a POST request to the '/ftp.html' endpoint with the 'submit' parameter set to 'Upload File' and the 'ftp_file' parameter containing the payload. The application will execute the command specified in the 'ftp_file' parameter on the server.