Valentin Lobstein
dfe73bb4c5
Unauthenticated OS command injection via the base64Url parameter in getImage.php. The URL is interpolated into an ffmpeg shell command without escapeshellarg(), and FILTER_VALIDATE_URL does not block shell metacharacters in the URL path.
This is the folder where all of Metasploit's modules live. These modules are scripts in Ruby that interface with
Metasploit itself to perform some specific task. There are various types of modules, such as exploit modules to
exploit a vulnerability and gain a shell, auxiliary to perform a non-shell gaining activity, payloads for
Metasploit's various payloads (which are also modules), and post for post exploitation modules.