Executive brief
Rainbow Aggregate DNS Management System, a tool used for managing DNS records, contains a security flaw in its diagnostic utilities. An attacker with local access to the system can execute unauthorized commands by manipulating the network 'ping' function. This could allow an attacker to take full control of the server, steal sensitive data, or install malicious software.
Technical details
A command injection vulnerability exists in the ping() function within the app\utils\CheckUtils.php file of Rainbow Aggregate DNS Management System. The root cause is the lack of input validation or escaping on the $target parameter, which is directly concatenated into a system call using the exec() function. A local attacker can exploit this by providing a malicious payload containing command separators (e.g., & or ;) to execute arbitrary system commands with the privileges of the web server. Successful exploitation can lead to full system compromise, including file traversal and unauthorized file writing.
Affected products
- Rainbow Rainbow Aggregate DNS Management System 2.15 and earlier
Timeline
- 2026-07-30: disclosed: Initial disclosure via GitHub and NVD publication