PHP : Command injection

Executing commands obtained from data from an untrusted source is insecure.

Running commands without setting precise absolute path allow an attacker to execute malicious code, changing the value of $PATH or other environment parameters.

Vulnerabilities such as command injection are divided into two categories:

1. The attacker modifies the command itself;
2. The attacker replaces the value of environment variables, implicitly changing the semantics of the command being executed.

In the given case, the application is prone to a first type of vulnerability.

Possible attack scenario:

1. The application receives input data from an untrusted source, for example, data is entered by the user.
2. The data obtained is used as a part of the line that defines the command.
3. The command execution gives the attacker the rights that he did not previously possess.