First Flight #6: Voting Booth

Summary

The testPwn function use cheatcode module that malicious command might be injected to execute attack to user's system.

Vulnerability Details

The test suite incorporates a testPwned function that carries out arbitrary commands on the user's system. This poses a notable security threat, as these commands have the potential to retrieve sensitive data, create a reverse shell for remote manipulation, seek passwords, or deploy malware.

The testPwned() contains malicious code injected, and loss of data might occurs when execution of the function.

Impact

Loss of sensitive data or the deletion of file and folder with malicious command.

Tools Used

Manual Review, Foundry Test

Recommendations

Ensure the command running, or avoid using such commands if unnecessary.