Back to scan results
What this check probes
The discovery stage inspects same-origin GET forms and links for parameter names such as cmd, command, exec, host, target, lookup, and query. A small root-page fallback covers common inputs when the page does not advertise a suitable form.
Each selected input receives two command-free canaries: POSIX arithmetic expansion and a Windows environment-variable expansion. A failure requires the exact expanded canary value to appear only in the probe response. Raw reflection of the original value is not a finding.
Additional probes contain only incomplete shell syntax, such as a trailing pipe or an unmatched substitution delimiter. New shell-specific parser errors or new HTTP 5xx responses produce a warning for manual review. Delays and ordinary HTTP 200 responses are not treated as evidence.
The scan never submits whoami, id, dir, ping, sleep, PowerShell, file operations, callbacks, or any other OS command. It does not test POST bodies, authenticated pages, uploads, APIs not linked from the public page, or unadvertised diagnostic routes.
Why this matters for PCI DSS
OS command injection can let an attacker run programs with the web application's privileges, read configuration and payment data, alter application files, pivot into internal systems, or interrupt service. It is one of the highest-impact forms of injection.
PCI DSS secure-development requirements expect applications to prevent injection, validate untrusted input, minimize privileges, and avoid exposing sensitive implementation details. A pass here covers only the bounded public GET surface identified by this scanner.
How to fix it
Remove the shell from the data path. Use a platform API for the operation instead of building a command string. For example, .NET Framework can resolve a validated hostname directly:
if (!Regex.IsMatch(host, @"\A(?=.{1,253}\z)[A-Za-z0-9.-]+\z"))
throw new ArgumentException("Invalid host name.");
IPAddress[] addresses = Dns.GetHostAddresses(host);
Use equivalent structured APIs for files, HTTP requests, archives, image processing, and database operations. Never concatenate user input into cmd.exe /c, /bin/sh -c, PowerShell, or a script interpreter.
If an external executable is unavoidable, select the executable and operation from a fixed server-side allowlist, set UseShellExecute = false, validate every argument against the narrowest possible grammar, enforce a short timeout, cap captured output, and run it under a dedicated low-privilege account. Do not let the client choose the executable, switches, working directory, or environment.
Treat escaping as defense in depth, not the primary control: quoting rules differ between shells, operating systems, and child programs. Log rejected values without returning stack traces, command lines, filesystem paths, environment variables, or process output to the user.