Command injection vulnerability（命令注入漏洞，可以获取服务器权限）

[Rvn0xsy]

trojan/util/linux.go

Lines 97 to 100 in c5fafe2

	// LogChan 指定服务实时日志, 返回chan
	func LogChan(serviceName, param string, closeChan chan byte) (chan string, error) {
	cmd := exec.Command("bash", "-c", fmt.Sprintf("journalctl -f -u %s -o cat %s", serviceName, param))

LogChan 函数没有过滤param参数的输入，可以执行操作系统命令。

The LogChan function does not filter the input of the param parameter and can execute operating system commands.