Security: OS command injection.

--000000000000a587590656b67f16
Content-Type: multipart/alternative; boundary="000000000000a587580656b67f14"

--000000000000a587580656b67f14
Content-Type: text/plain; charset="UTF-8"

Hello,
The report is a markdown file and attached.
Please let me know if more information is needed

Thanks
Sakib Sarkar

--000000000000a587580656b67f14
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"gmail-ii gmail-gt" id=3D"gmail-:22h" style=
=3D"direction:ltr;margin:8px 0px 0px;padding:0px;font-size:0.875rem;overflo=
w-x:hidden;font-family:&quot;Google Sans&quot;,Roboto,RobotoDraft,Helvetica=
,Arial,sans-serif"><div class=3D"gmail-a3s gmail-aiL" id=3D"gmail-:22g" sty=
le=3D"direction:ltr;font-style:normal;font-variant:normal;font-size-adjust:=
none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;fon=
t-size:small;line-height:1.5;font-family:Arial,Helvetica,sans-serif;overflo=
w:auto hidden"><div id=3D"gmail-avWBGd-187"><div dir=3D"ltr">Hello,<br>The =
report is a markdown file and attached.<br>Please=C2=A0let me know if more=
=C2=A0information is needed<br><br>Thanks<font color=3D"#888888"><br>Sakib =
Sarkar</font></div><div class=3D"gmail-yj6qo"></div><div class=3D"gmail-adL=
"></div></div></div></div><div class=3D"gmail-hq gmail-gt" id=3D"gmail-:222=
" style=3D"font-size:0.875rem;margin:15px 0px;clear:both;font-family:&quot;=
Google Sans&quot;,Roboto,RobotoDraft,Helvetica,Arial,sans-serif"></div><br =
class=3D"gmail-Apple-interchange-newline"></div>

--000000000000a587580656b67f14--
--000000000000a587590656b67f16
Content-Type: text/markdown; charset="UTF-8"; name="kbdfile-command-injection-report.md"
Content-Disposition: attachment; 
	filename="kbdfile-command-injection-report.md"
Content-Transfer-Encoding: base64
Content-ID: <f_mrn7fwol0>
X-Attachment-Id: f_mrn7fwol0

IyBDb21tYW5kIEluamVjdGlvbiBpbiBsaWJrYmRmaWxlIERlY29tcHJlc3Npb24gRmFsbGJhY2sK
CioqQ1dFOioqIENXRS03OCAoT1MgQ29tbWFuZCBJbmplY3Rpb24pIAoqKkNvbXBvbmVudDoqKiBg
c3JjL2xpYmtiZGZpbGUva2JkZmlsZS5jYCDigJQgYGtiZGAgcHJvamVjdCAobGVnaW9udXMva2Jk
KQoqKkFmZmVjdGVkIGNvbnN1bWVyczoqKiBgbG9hZGtleXNgLCBgc2V0Zm9udGAsIGBwc2Z4dGFi
bGVgIAoKLS0tCgojIyAxLiBTdW1tYXJ5CgpgbGlia2JkZmlsZWAsIHRoZSBzaGFyZWQgZmlsZS1v
cGVuaW5nIGxheWVyIHVzZWQgYnkgYGxvYWRrZXlzYCwgYHNldGZvbnRgLCBhbmQgYHBzZnh0YWJs
ZWAsIGJ1aWxkcyBhIHNoZWxsIGNvbW1hbmQgc3RyaW5nIGZyb20gYW4gdW5zYW5pdGl6ZWQgZmls
ZSBwYXRoIGFuZCBleGVjdXRlcyBpdCB2aWEgYHBvcGVuKClgIHdoZW4gaXRzIGluLXByb2Nlc3Mg
ZGVjb21wcmVzc2lvbiBmYWxsYmFjayBpcyB1bmF2YWlsYWJsZS4gQSBwYXRoIGNvbnRhaW5pbmcg
c2hlbGwgbWV0YWNoYXJhY3RlcnMgcmVzdWx0cyBpbiBhcmJpdHJhcnkgY29tbWFuZCBleGVjdXRp
b24gaW4gdGhlIGNvbnRleHQgb2YgdGhlIHByb2Nlc3MgcnVubmluZyB0aGUgYWZmZWN0ZWQgdG9v
bC4KCkJlY2F1c2UgdGhlIHZ1bG5lcmFibGUgY29kZSBsaXZlcyBpbiB0aGUgc2hhcmVkIGxpYnJh
cnkgcmF0aGVyIHRoYW4gaW4gYW55IGluZGl2aWR1YWwgYmluYXJ5LCAqKmV2ZXJ5IGNvbnN1bWVy
IG9mIGxpYmtiZGZpbGUgaW5oZXJpdHMgdGhlIGJ1ZyoqIOKAlCB0aGlzIGlzIG5vdCBzcGVjaWZp
YyB0byBvbmUgdG9vbCdzIGFyZ3VtZW50IHBhcnNpbmcuCgotLS0KCiMjIDIuIFRlY2huaWNhbCBE
ZXRhaWxzCgojIyMgMi4xIFJvb3QgY2F1c2UKCkluIGBzcmMvbGlia2JkZmlsZS9rYmRmaWxlLmNg
OgoKLSBgb3Blbl9wYXRobmFtZSgpYCBpbnNwZWN0cyB0aGUgZmlyc3QgdHdvIGJ5dGVzIG9mIGEg
ZmlsZSBmb3Iga25vd24gY29tcHJlc3Npb24gbWFnaWMuIElmIGEgbWF0Y2ggaXMgZm91bmQsIGl0
IGZpcnN0IHRyaWVzIHRoZSBjb3JyZXNwb25kaW5nIGluLXByb2Nlc3MgZGVjb21wcmVzc29yIChs
b2FkZWQgYXQgcnVudGltZSB2aWEgYGRsb3BlbmAgYWdhaW5zdCBsaWJ6L2xpYmx6bWEvbGlienN0
ZC9saWJiejIpLgotIElmIHRoYXQgZGVjb21wcmVzc29yIGlzIHVuYXZhaWxhYmxlIChsaWJyYXJ5
IG5vdCBpbnN0YWxsZWQsIGBkbG9wZW5gIGZhaWxzKSBhbmQgYEtCREZJTEVfSUdOT1JFX0RFQ09N
UF9VVElMU2AgaXMgbm90IHNldCwgaXQgZmFsbHMgYmFjayB0byBgcGlwZV9vcGVuKClgIChrYmRm
aWxlLmM6MTQ54oCTMTY3KToKCmBgYGMKc3RhdGljIGludApwaXBlX29wZW4oY29uc3Qgc3RydWN0
IGRlY29tcHJlc3NvciAqZGMsIHN0cnVjdCBrYmRmaWxlICpmcCkKewoJY2hhciAqcGlwZV9jbWQ7
CgoJcGlwZV9jbWQgPSBtYWxsb2Moc3RybGVuKGRjLT5jbWQpICsgc3RybGVuKGZwLT5wYXRobmFt
ZSkgKyAyKTsKCWlmIChwaXBlX2NtZCA9PSBOVUxMKQoJCXJldHVybiAtMTsKCglzcHJpbnRmKHBp
cGVfY21kLCAiJXMgJXMiLCBkYy0+Y21kLCBmcC0+cGF0aG5hbWUpOwoKCWZwLT5mZCA9IHBvcGVu
KHBpcGVfY21kLCAiciIpOwoJLi4uCn0KYGBgCgpgZnAtPnBhdGhuYW1lYCBpcyB0aGUgY2FsbGVy
LXN1cHBsaWVkIHBhdGgsIHNldCBkaXJlY3RseSB2aWEgYGtiZGZpbGVfc2V0X3BhdGhuYW1lKClg
IG9yIGNvbnN0cnVjdGVkIHdpdGggYW4gYXBwZW5kZWQgc3VmZml4IChgLmd6YC9gLmJ6MmAvYC54
emAvYC56c3RgKSBpbiBgbWF5YmVfcGlwZV9vcGVuKClgLiBJdCBpcyBuZXZlciBzaGVsbC1xdW90
ZWQsIGVzY2FwZWQsIG9yIHZhbGlkYXRlZC4gYHBvcGVuKClgIGludm9rZXMgYC9iaW4vc2ggLWNg
IG9uIHRoZSByZXN1bHRpbmcgc3RyaW5nLCBzbyBzaGVsbCBtZXRhY2hhcmFjdGVycyAoYDtgLCBg
fGAsIGBgIGAgYGAsIGAkKClgLCBldGMuKSBpbiB0aGUgcGF0aCBhcmUgaW50ZXJwcmV0ZWQgYnkg
dGhlIHNoZWxsIHJhdGhlciB0aGFuIHRyZWF0ZWQgYXMgYSBsaXRlcmFsIGZpbGVuYW1lLgoKIyMj
IDIuMiBUcmlnZ2VyIGNvbmRpdGlvbnMKClRoZSB2dWxuZXJhYmxlIHBhdGggaXMgcmVhY2hlZCB3
aGVuOgoxLiBBIGZpbGUncyBtYWdpYyBieXRlcyAob3Igc3VmZml4LCB2aWEgYG1heWJlX3BpcGVf
b3BlbigpYCdzIHJldHJ5IGxvZ2ljKSBtYXRjaCBhIHN1cHBvcnRlZCBjb21wcmVzc2lvbiBmb3Jt
YXQsICoqYW5kKioKMi4gVGhlIGluLXByb2Nlc3MgZGVjb21wcmVzc29yIGZvciB0aGF0IGZvcm1h
dCBpcyB1bmF2YWlsYWJsZSBhdCBydW50aW1lIChtaXNzaW5nIHNoYXJlZCBsaWJyYXJ5IGRlcGVu
ZGVuY3kpLgoKVGhpcyBtYWtlcyB0aGUgYnVnIGxhdGVudC9lbnZpcm9ubWVudC1kZXBlbmRlbnQ6
IG9uIHN5c3RlbXMgd2hlcmUgemxpYi9saWJsem1hL2V0Yy4gYXJlIGFsd2F5cyBwcmVzZW50LCB0
aGUgaW4tcHJvY2VzcyBwYXRoIGlzIHRha2VuIGFuZCB0aGUgc2hlbGwgZmFsbGJhY2sgaXMgbmV2
ZXIgcmVhY2hlZC4gT24gbWluaW1hbCBvciBzdHJpcHBlZC1kb3duIHN5c3RlbXMgKGNvbnRhaW5l
cnMsIGVtYmVkZGVkIGltYWdlcywgY3VzdG9tIGluc3RhbGxzKSwgdGhlIGZhbGxiYWNrIGJlY29t
ZXMgbGl2ZS4KCiMjIyAyLjMgUHJvb2Ygb2YgY29uY2VwdAoKYGBgc2gKIyEvYmluL3NoCiMgUG9D
OiBjb21tYW5kIGluamVjdGlvbiB2aWEgdW5zYW5pdGl6ZWQgcGF0aCBpbiBrYmRmaWxlIHBpcGVf
b3BlbiBmYWxsYmFjawpzZXQgLWUKV09SSz0iL3RtcC94OyB0b3VjaCAvdG1wL1BXTkVEICMiCm1r
ZGlyIC1wICIkV09SSyIKcHJpbnRmICdceDFmXHg4Ylx4MDhceDAwXHgwMFx4MDBceDAwXHgwMFx4
MDBceGZmJyA+ICIkV09SSy9ldmlsLmd6Igpsb2Fka2V5cyAiJFdPUksvZXZpbC5neiIgMj4vZGV2
L251bGwgfHwgdHJ1ZQpbIC1lIC90bXAvUFdORUQgXSAmJiBlY2hvICJWVUxORVJBQkxFIiB8fCBl
Y2hvICJub3QgdHJpZ2dlcmVkIChpbi1wcm9jZXNzIGRlY29tcHJlc3NvciBwcmVzZW50KSIKYGBg
CgpXaXRoIGxpYnogYWJzZW50LCBgbG9hZGtleXNgIHJlc29sdmVzIHRoZSBnemlwIG1hZ2ljLCB0
aGUgaW4tcHJvY2VzcyBkZWNvbXByZXNzb3IgcmV0dXJucyBgTlVMTGAsIGFuZCBgcGlwZV9vcGVu
KClgIGV4ZWN1dGVzIGBnemlwIC1kIC1jIC90bXAveDsgdG91Y2ggL3RtcC9QV05FRCAjL2V2aWwu
Z3pgIHZpYSB0aGUgc2hlbGwg4oCUIHRoZSBgO2AgdGVybWluYXRlcyB0aGUgaW50ZW5kZWQgY29t
bWFuZCBhbmQgcnVucyB0aGUgaW5qZWN0ZWQgb25lLgoKLS0tCgojIyAzLiBSZW1lZGlhdGlvbgoK
MS4gKipQcmltYXJ5IGZpeCDigJQgZWxpbWluYXRlIHRoZSBzaGVsbCBlbnRpcmVseS4qKiBSZXBs
YWNlIHRoZSBgcG9wZW4oKWAtYmFzZWQgZmFsbGJhY2sgd2l0aCBhIGRpcmVjdCBgZm9yaygpYC9g
ZXhlY3ZwKClgIChvciBgcG9zaXhfc3Bhd25gKSBjYWxsIHVzaW5nIGFuIGFyZ3YgYXJyYXksIHNv
IHRoZSBwYXRoIGlzIG5ldmVyIGludGVycHJldGVkIGJ5IGAvYmluL3NoYDoKCmBgYGMKc3RhdGlj
IGludApwaXBlX29wZW4oY29uc3Qgc3RydWN0IGRlY29tcHJlc3NvciAqZGMsIHN0cnVjdCBrYmRm
aWxlICpmcCkKewoJaW50IHBpcGVmZFsyXTsKCXBpZF90IHBpZDsKCglpZiAocGlwZShwaXBlZmQp
ICE9IDApCgkJcmV0dXJuIC0xOwoKCXBpZCA9IGZvcmsoKTsKCWlmIChwaWQgPT0gMCkgewoJCWR1
cDIocGlwZWZkWzFdLCBTVERPVVRfRklMRU5PKTsKCQljbG9zZShwaXBlZmRbMF0pOwoJCWNsb3Nl
KHBpcGVmZFsxXSk7CgkJZXhlY2xwKGRjLT5jbWRfdG9rZW4sIGRjLT5jbWRfdG9rZW4sIGZwLT5w
YXRobmFtZSwgKGNoYXIgKilOVUxMKTsKCQlfZXhpdCgxMjcpOwoJfQoJY2xvc2UocGlwZWZkWzFd
KTsKCWZwLT5mZCA9IGZkb3BlbihwaXBlZmRbMF0sICJyIik7CglyZXR1cm4gKGZwLT5mZCA9PSBO
VUxMKSA/IC0xIDogMDsKfQpgYGAK
--000000000000a587590656b67f16--