An issue exists in Pi-Hole up to and including 5.0. The local www-data user has sudo privileges to execute the pihole core script as root without a password, which could allow an malicious user to obtain root access via shell metacharacters to this script's setdns command.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
pi-hole pi-hole |
Vulmon