CVE-2025-1845 – ESAFENET DSM examExportPDF command injection

https://notcve.org/view.php?id=CVE-2025-1845

03 Mar 2025 — A vulnerability has been found in ESAFENET DSM 3.1.2 and classified as critical. Affected by this vulnerability is the function examExportPDF of the file /admin/plan/examExportPDF. The manipulation of the argument s leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. • https://github.com/666lail/report/blob/main/tmp/2.md • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •