Command injection via db_dir configuration parameter
Brought to you by:
jmaggard
There is a command injection vulnerability via the db_dir configuration parameter.
To reproduce:
db_dir=x; cat /etc/passwd;#minidlna -f minidlna.confThis is risky because minidlna is used in several routers, executed with elevated privileges, and that parameter might be controllable by an attacker.
The vulnerable code is located at https://github.com/1100101/minidlna/blob/master/minidlna.c#L454 and at line 890 of the same file, when the -R flag is specified explicitly. Please avoid string concatenation to parameters passed to system().
Issues with minidlna.c and system() have been previously reported in Tickets>Bugs #273.