CorgetGpsDget 2.3.2 – Unauthenticated OS Command Injection Allows Root‑Level Code Execution
What Happened – Researchers disclosed an unauthenticated OS command injection in CorgetGpsDget 2.3.2 (build 2020‑09‑01). The vulnerable SendEmail handler concatenates the Target header into a system() call, enabling an attacker to run arbitrary commands as root. No CVE has been assigned yet, but the exploit is publicly available on Exploit‑DB (EDB‑ID 52631).
Why It Matters for Compliance & Audit Readiness
- The flaw bypasses basic access‑control safeguards, directly violating SOC 2 CC6.1 (system operations) and CC6.2 (change management) requirements for protecting production environments.
- Continuous control monitoring must capture evidence that all web‑application inputs are validated and that privileged commands are never executed from user‑controlled data.
- Verisq’s Control Mapping capability can automatically map this vulnerability to the relevant SOC 2 controls and generate audit‑ready evidence of remediation.
Who Is Affected – Companies that deploy CorgetGpsDget (or similar GPS‑tracking web services) across any industry; typical users are logistics, field‑service, and IoT SaaS providers.
Recommended Actions
- Immediately block the
SendEmailendpoint or apply input sanitisation for theTargetheader. - Patch or upgrade to a version where the
system()call is removed or properly escaped. - Document the remediation in your SOC 2 evidence repository and map the fix to CC6.1/CC6.2 using a control‑mapping tool.
Technical Notes – The injection occurs in http/HttpHandler.cpp (CHttpHandler::SendEmail). An attacker sends a crafted Target: x;<cmd>; header; the server executes system("echo '<body>'|mail -r 'service@corget.com' -s '<subject>' <Target>"). Exploit runs as root on the host (tested on Ubuntu/Debian). No CVE assigned yet (pending). Source: Exploit‑DB 52631