Zend.To Command Injection Vulnerability in NSSDropoff.php

A critical command injection vulnerability has been identified in Zend.To versions prior to 6.10-7 Beta. The issue arises in the NSSDropoff.php file, where the exec function is called with unsanitized file names from user uploads. This vulnerability allows unauthenticated attackers to execute arbitrary system commands during the file upload process. The vulnerability can be exploited remotely.

Impact

Exploitation of this vulnerability allows for unauthenticated remote code execution on the server where Zend.To is installed.

Reproduction

The vulnerability can be reproduced by uploading a file through the application's file transfer interface. The uploaded file's 'tmp_name' parameter can be manipulated to include arbitrary commands, which are then executed on the server via the exec function in NSSDropoff.php.

Remediation

Users are advised to upgrade to Zend.To version 6.10-7 or later.