CyberRota Analysis
AI-GeneratedAn OS command injection vulnerability in alseambusher/crontab-ui versions up to 0.4.2 allows unauthenticated remote attackers to execute arbitrary system commands by importing a malicious crontab database file. The vulnerability arises from the lack of validation on the POST /import endpoint, which directly embeds user-controlled input into shell commands, leading to potential system compromise. Organizations using this application should prioritize immediate remediation to mitigate the risk of unauthorized command execution.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files and overwrites the application database without validation.