Skip to content

Command-Injection.md

Latest commit

 

History

History
121 lines (72 loc) · 2.3 KB

Command-Injection.md

File metadata and controls

121 lines (72 loc) · 2.3 KB

Command Injection Vulnerability Report

1. Overview

This report documents a Command Injection vulnerability identified in DVWA during security testing.

Testing Type: Offensive + Defensive Analysis
Environment: Local Lab
Security Level Tested: Low

2. Vulnerability Details

  • Vulnerability Name: Command Injection
  • Severity: Critical
  • Category: OWASP Top 10 – Injection
  • Affected Module: DVWA – Command Injection (Ping a Device)

3. Description

The application executes system-level commands using user-supplied input without proper validation or sanitization.

This allows attackers to inject additional operating system commands.

4. Proof of Concept (PoC)

Payload Used:

127.0.0.1; ls

Steps to Reproduce:

  1. Login to DVWA.
  2. Navigate to the "Command Injection" module.
  3. Enter the payload in the IP address field.
  4. Click Submit.

Observed Result:

After normal ping output, the following directory listing was displayed:

  • help
  • index.php
  • source

This confirms that the injected ls command was executed successfully.

proof

5. Technical Analysis

Backend Concept (Insecure):

system("ping " . $target);

After Injection:

ping 127.0.0.1; ls

The semicolon (;) allows execution of multiple commands in sequence.

Thus, the server executed both:

  1. ping 127.0.0.1
  2. ls

6. Impact Analysis

If exploited in a real-world environment, this vulnerability could lead to:

  • Server file disclosure
  • Access to sensitive configuration files
  • Execution of arbitrary system commands
  • Reverse shell access
  • Complete server compromise

7. Root Cause

  • Direct use of system() function
  • Lack of input validation
  • No command escaping or filtering

8. Risk Classification

Severity Level: Critical
Reason: Allows remote command execution on the server.

9. Remediation Strategy

To prevent Command Injection:

  • Avoid using system() or shell execution functions
  • Use strict input validation (IP format validation)
  • Implement allowlist validation
  • Use escapeshellarg() when necessary

Secure Example (Conceptual):

$target = escapeshellarg($target); system("ping " . $target);

10. Ethical Disclaimer

This testing was performed in a controlled lab environment (DVWA) strictly for educational and research purposes.