Prompt Injection in Headers Can Lead to Command Injection Vulnerabilities

[bayegaspard]

Just like what I described in #3
we can see both the URL and headers parameters are susceptible to RCE. For instance, a custom header could include any system commands like whoami with back ticks, leading to potential exploitation on the pentester's server.

[bayegaspard]

The same

thing can be seen for Max-per-class.

[sh0z3n]

exaclty , this part should be handled diffrently :
ffuf_command = [args.ffuf_path] + unknown + ['-e', extensions]
subprocess.run(ffuf_command)

[philipsinnott]