CyberRota Analysis
AI-GeneratedThe vulnerability affects Telenia Software TVox versions 26.5.3 and earlier, as well as 24.9.21 and earlier, allowing authenticated attackers to exploit an OS command injection flaw in the action_audio.php script. By manipulating the unsanitized pid parameter, attackers can execute arbitrary commands with the privileges of the Apache user, potentially leading to unauthorized access or system compromise. Organizations using these affected versions should prioritize patching this vulnerability to mitigate the risk of exploitation.
Original NVD Description
Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an OS command injection vulnerability in action_audio.php that allows authenticated attackers to execute arbitrary operating system commands by passing an unsanitized pid parameter into an exec() call when the action parameter is set to checkProcess. Attackers can inject malicious OS commands through the pid request parameter to execute arbitrary commands with the privileges of the apache user.