$ grep -r "command-injection"
A Spring Boot app leaks an admin session cookie through an exposed Actuator endpoint, giving access to a dashboard whose SSH feature is vulnerable to command injection. A reverse shell leads to the application JAR, which holds hardcoded PostgreSQL credentials; the database yields a bcrypt hash that cracks to the password for the user josh. josh may run ssh as root via sudo, and the LocalCommand directive is abused to execute a shell as root.
A file-upload form validates image extension and MIME magic bytes but permits a PHP double extension, which an Apache handler misconfiguration executes, yielding a shell as www-data. A cron job running as guly passes uploaded filenames unsanitised to exec(), so a filename containing shell metacharacters achieves command injection and a shell as guly. guly may run a network-configuration script as root that reads interface values into a config file, and a known ifcfg script-injection flaw turns those values into root command execution.
A Request Baskets instance is vulnerable to SSRF (CVE-2023-27163), which we use to reach a firewalled Maltrail service. Maltrail's unauthenticated command injection gives a reverse shell as puma, and a sudo-allowed systemctl status is escalated to root through its pager.
Command injection in the Searchor Python library gives a foothold as svc, reused Git credentials unlock a local Gitea instance, and a root-run checkup script that calls a script by relative path is hijacked for RCE as root.