CVE-2019-25441

CVE-2019-25441 is a command injection vulnerability (CWE-78) affecting thesystem version 1.0, specifically in the run_command endpoint. The flaw enables unauthenticated attackers to execute arbitrary system commands by submitting malicious input via POST requests, where shell commands are injected through the command parameter. This results in remote code execution on the server without requiring authentication. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low complexity, and potential for complete compromise of confidentiality, integrity, and availability.

Unauthenticated remote attackers can exploit this vulnerability by sending crafted POST requests to the run_command endpoint with malicious payloads in the command parameter. Successful exploitation allows arbitrary command execution on the server, potentially leading to full system compromise, data exfiltration, privilege escalation, or deployment of persistent malware.

Advisories and related resources, including the GitHub repository at https://github.com/kostasmitroglou/thesystem, an Exploit-DB entry at https://www.exploit-db.com/exploits/47441, and a VulnCheck advisory at https://www.vulncheck.com/advisories/thesystem-command-injection-via-runcommand-endpoint, provide further details on the issue, proof-of-concept exploits, and potential mitigation guidance such as input validation or endpoint restrictions.