Description
ClamAV存在命令注入漏洞，该漏洞是由于对请求头中的filename参数的值验证不当造成的。
ClamAV CVE-2024-20328 命令注入漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://avd.aliyun.com/product?prod=clamav
https://cve.imfht.com/detail/CVE-2024-20328
https://www.nsfocus.net/vulndb/92958
https://www.sxxdckj.com/cms/a/ClamAV-ming-ling-zhi-xing-lou-dong.html
https://www.tenablecloud.cn/plugins/nessus/190351
https://nvd.nist.gov/vuln/detail/cve-2024-20328
https://www.rapid7.com/db/vulnerabilities/freebsd-cve-2024-20328/
https://security.snyk.io/vuln/SNYK-CHAINGUARDLATEST-CLAMAV13-8663887
https://www.sonicwall.com/blog/clamav-clamd-service
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2024-20328
https://dayzerosec.com/vulns/2024/02/19/clamav-not-so-calm-cve-2024-20328.html
https://github.com/advisories/GHSA-vhq6-cjc8-x8v9