CVE-2019-17526

# Exploit Title: SageCell Python Web Injection Vulnerability 
# Google Dork: 
# Date: 10/13/19
# Exploit Author: Christopher J. Barretto @ Advoqt
# Vendor Homepage: www.advoqt.com
# Software Link: https://sagecell.sagemath.org/
# Version: SageCell - ALL VERSIONS 
# Tested on: Unix
# CVE : CVE-2019-17526 (issued in progress)

Python Code Injection can occur in the context of an internet facing web application. Malicious actors can execute arbitrary commands on the
underlying operating system, as demonstrated by:

__import__('os').popen('whoami').read()  

Can also gain reverse shell. 
NOTE: The vendor's position is that the product is "vulnerable by design" and the current behavior will be retained.