antisecc/cve-2022-23935Exploit for CVE-2022-23935, a command injection vulnerability in Exiftool versions prior to 12.38, allowing arbitrary command execution via crafted filenames.
The Exiftool software program, in versions prior to 12.38, has a security vulnerability that can be exploited through a specially crafted filename.
This vulnerability allows for command injection, where an attacker can execute arbitrary commands on the system by appending a pipe character '|' to the end of the filename, causing the file to be treated as a command to be executed rather than as a regular file.
As a result, any file on the system that has this naming convention can be potentially used to execute malicious code.
