Speaking of filtering, the diff between the two exploits is: -"common_name=a'\$(ping -c 4 192.168.1.2)'b" +"common_name='a\$(ping -c 4 192.168.1.2)'b"

Speaking of filtering, the diff between the two exploits is: -"common_name=a'\$(ping -c 4 192.168.1.2)'b" +"common_name='a\$(ping -c 4 192.168.1.2)'b" and POST instead of GET (and kurl as the UA, of course). Does their fix specifically check for injection starting with `a'` ? And only works for GET requests? Mind-boggling... Edit: The new exploit also targets https instead of http. I would've said that surely that would not make a difference, but given what's already happened I'm not sure.