NeDi 1.9C allows an authenticated user to execute operating system commands in the Nodes Traffic function on the endpoint /Nodes-Traffic.php via the md or ag HTTP GET parameter. This allows an malicious user to obtain access to the operating system where NeDi is installed and to all application data.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
nedi nedi 1.9c |
Vulmon