CVE-2024-29640: aliyundrive-webdav vulnerable to Command Injection

The vulnerability occurs in the action_query_qrcode handler where the 'sid' parameter from the HTTP request is unsafely interpolated into a shell command. The code executes 'aliyundrive-webdav qr query --sid ' + user_input using luci.sys.exec, which passes the input through system shell interpretation. This allows attackers to inject arbitrary commands by including shell metacharacters in the sid parameter. The provided exploit example demonstrates successful command injection through the sid parameter, and the code structure clearly shows lack of input validation or escaping.