command-injection-path.js

const exec = require('child_process').exec;
var express = require('express');
var app = express();

app.get('/listfile/:data', function(req, res, next) {
	exec('ls -la' + req.param('data'), (error, stdout, stderr) => {
  if (error) {
    throw error;
  }
  console.log(stdout);
  res.send(stdout);
});
});
app.listen(3000);
console.log('Server Berjalan Port 3000 :)');