command-injection-true.js

const execFile = require('child_process').execFile;
var express = require('express');
var app = express();

app.get('/listfile/:data', function(req, res, next) {
	execFile('ls' , ['-la',req.param('data')], (error, stdout, stderr) => {
  if (error) {
    throw error;
  }
  console.log(stdout);
  res.send(stdout);
});
});
app.listen(3000);
console.log('Server Berjalan Port 3000 :)');