O-CMS 1.0.0 Authenticated OS Command Injection via ai_cli_script

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-09-04 00:13 UTC
Importiert: 2026-09-08 18:19 UTC
Quelle-ID: full_disc
uid_hash: 942bf83f507f8382bdec95b2a23e6a41748373ee5d5f2e70c33f5a800907c918

Full Disclosure

Posted by Ron E on Sep 03 Description

O-CMS version 1.0.0 contains an authenticated OS command injection

vulnerability in the AI CLI configuration functionality. An authenticated

attacker with sufficient privileges can supply shell metacharacters and

additional commands through the ai_cli_script parameter of

/admin/settings/save.

When the configured AI provider is subsequently tested through

/admin/settings/test-ai, the attacker-controlled CLI value is executed in a...

No data

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
Full Disclosure	full_disc	threat_intel		-	de	https://seclists.org/rss/fulldisclosure.rss