mirror of
https://github.com/elicpeter/nyx.git
synced 2026-06-15 20:05:13 +02:00
23 lines
463 B
Go
23 lines
463 B
Go
// Phase 17 (Track L.15) — fiber CMDI vuln fixture.
|
|
//
|
|
// The /run route forwards a `cmd` query parameter straight into
|
|
// `os/exec.Command`. Adapter binding: `app.Get("/run", Run)` with
|
|
// `cmd` flowing through `c.Query`.
|
|
package main
|
|
|
|
import (
|
|
"os/exec"
|
|
|
|
"github.com/gofiber/fiber/v2"
|
|
)
|
|
|
|
func Run(c *fiber.Ctx) error {
|
|
cmd := c.Query("cmd")
|
|
return exec.Command("sh", "-c", cmd).Run()
|
|
}
|
|
|
|
func main() {
|
|
app := fiber.New()
|
|
app.Get("/run", Run)
|
|
_ = app
|
|
}
|