tz.pl on XoruX LPAR2RRD and STOR2RRD 2.70 virtual appliances allows cmd=set&tz=OS command injection via shell metacharacters in a timezone.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24032
Reference (s):
- https://pastebin.com/G8981Fj8
- https://pastebin.com/dHhawgx8
- https://www.stor2rrd.com/download.php