The flaw exists in the revertBackup function of dst-admin up to version 1.5.0. By manipulating the Name parameter supplied to that function, an attacker can inject arbitrary shell commands. The vulnerability enables remote command execution against the hosting system, allowing elevation of privileges, data exfiltration, or complete takeover. The vendor did not respond to the disclosure, and a public exploit has already been released.

Affected installations are those running qinming99’s dst-admin product version 1.5.0 or earlier. The product is typically deployed on Linux environments (as noted by the /home/restore path) and can be identified by its CPE entry corresponding to the qinming99 dst-admin project.

The CVSS score is 5.3, indicating a moderate severity, while the EPSS score of less than 1% suggests a low probability of widespread exploitation. Nevertheless, the vulnerability is remote, exploitable over the network, and has a publicly available exploit, making it a real risk for exposed installations. It is not currently listed in the CISA KEV catalog.