Ruijie WS7204-A OS Command Injection Vulnerability

An OS command injection vulnerability has been identified in the Ruijie WS7204-A AC wireless controller, specifically in the version released on June 15, 2017. The issue arises in the file '/itbox_pi/branch_import.php?a=branch_list', where the 'province' parameter can be manipulated to inject operating system commands. This vulnerability can be exploited remotely, and a public exploit is available.

Impact

Exploitation of this vulnerability allows for arbitrary OS command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to '/itbox_pi/branch_import.php?a=branch_list' with the 'province' parameter set to a crafted value that includes OS commands. The injected command will be executed on the server, and the output can be redirected to a file.