A critical command injection vulnerability in Tosei Online Store Management System version 1.01 allows unauthenticated remote attackers to execute arbitrary system commands.

This is a command injection vulnerability (CWE-77) occurring in the /cgi-bin/imode_alldata.php file. An unauthenticated attacker can trigger the flaw by sending a specifically crafted payload to the DevId argument.

The ability for an unauthenticated remote attacker to execute arbitrary commands poses a severe risk to the confidentiality, integrity, and availability of the affected system. Successful exploitation could lead to full system compromise, unauthorized data exfiltration, or the deployment of persistent threats within the internal network. With a CVSS score of 7.3, this high-severity vulnerability requires immediate attention to prevent unauthorized system access.

Immediate Action: As no official patch is currently available from the vendor, restrict network access to the /cgi-bin/imode_alldata.php file at the network perimeter or web server configuration level.

Proactive Monitoring: Review web server access logs for suspicious requests targeting the /cgi-bin/imode_alldata.php file, specifically looking for unusual character strings or command characters within the DevId parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common command injection patterns and unauthorized requests to the vulnerable CGI script.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the research write-up referenced in the CVE record.

Given the availability of a public proof-of-concept and the lack of a vendor-provided patch, this vulnerability presents a significant risk to exposed systems. Organizations should prioritize isolating the affected component from public network access immediately. Continuous monitoring for indicators of compromise is essential until a formal security update is released by Tosei.