mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 19:59:26 +00:00
24 lines
582 B
C++
24 lines
582 B
C++
|
// Command-execution and format-string vulnerabilities.
|
||
|
|
#include <cstdio>
|
||
|
|
#include <cstdlib>
|
||
|
|
#include <unistd.h>
|
||
|
|
|
||
|
|
void run_cmd(char *arg) {
|
||
|
|
char cmd[256];
|
||
|
|
strcpy(cmd, arg);
|
||
|
|
system(cmd); // CWE-78 system runs attacker-controlled command
|
||
|
|
}
|
||
|
|
|
||
|
|
void read_pipe(char *arg) {
|
||
|
|
FILE *fp = popen(arg, "r"); // CWE-78 popen runs attacker-controlled command
|
||
|
|
if (fp) pclose(fp);
|
||
|
|
}
|
||
|
|
|
||
|
|
void launch(char *arg) {
|
||
|
|
execlp("sh", "sh", "-c", arg, (char *)NULL); // CWE-78 execlp runs attacker input
|
||
|
|
}
|
||
|
|
|
||
|
|
void log_msg(char *user) {
|
||
|
|
printf(user); // CWE-134 format string controlled by attacker
|
||
|
|
}
|