OpenCATS: Authenticated Remote Code Execution via SettingsUI (manageProfessional)

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, the Professional License configuration feature in SettingsUI (manageProfessional) accepts administrator-controlled license key input that is reconstructed into a PHP define() statement in config.php without safe escaping. Because the application includes config.php, crafted input can alter the file's PHP syntax and cause persistent arbitrary PHP execution with the web server process privileges. An authenticated administrator must have Settings module access and permission to update Professional License configuration, and config.php must be writable for this write-based path. Successful exploitation can read, modify or delete application data, expose candidate, contact, company, job order and user account information, alter the installation or configuration, and provide a foothold for further attacks. Unauthenticated exploitation and exploitation without Settings access are not established. This issue is fixed in version 0.10.0.

Etkilenen sürümler1 yazılım

Kaynaklar6 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…enCATS/security/advisories/GHSA-627w-743r-4cg2 Diğer
• github.com/opencats/OpenCATS/pull/802 Diğer
• github.com/…ommit/e422abf3b75d467bdee65277f56e41dfba928fc8 Diğer
• github.com/opencats/OpenCATS/tree/v0.10.0 Diğer

Kayıt geçmişi

1. 29 Eki 2026 00:53Yayımlandı

İlgili açıklar

• 7,6 CVE-2026-54455OpenCATS: Authenticated SQL injection in activity DataGrid date filters
• 8,7 CVE-2026-115513OpenCATS'te MRU gezinme panelinden kaynaklanan kalıcı siteler arası betik çalıştırma (XSS) açığı
• 10,0 CVE-2026-61564AVideo-Encoder: unauthenticated installer PHP code injection
• 8,8 CVE-2026-118683MONAI 1.2.0 before 1.6.1 Code Execution via bundle configs/logging.conf
• 3,7 CVE-2026-118258i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string
• 7,8 CVE-2026-118618Ultralytics parse_model Code Injection Remote Code Execution Vulnerability