ID:10804 - Exploit for Code injection in EJS - CVE-2022-29078

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper input validation when parsing data passed to "settings[view options][outputFunctionName]". A remote attacker can send specially crafted request to the application, perform server-side template injection and execute arbitrary code on the system.

Remediation