💻 Code Review
🔐 Daily Cyber Challenge
Friday, 7 August 2026 · Challenge #219
🔥
0
Day streak
0
Solved
0
Best streak
PHP Web Shell
<?php
// admin/execute.php
$cmd = $_GET["command"];
$output = shell_exec($cmd);
echo "<pre>" . $output . "</pre>";
?>
What critical vulnerability exists in this code?
60s
Attempts:
+3
points
✅ Correct!
OS Command Injection (CWE-78): shell_exec() runs any command from the GET parameter. Payload: ?command=id;cat+/etc/passwd gives full server access. Fix: never pass user input to shell functions.
CWE-78 / OWASP A03