An authentication bypass vulnerability in Xerte Online Tools permits unauthenticated remote attackers to execute arbitrary code by triggering a reinstallation of the application.

The application incorrectly exposes the installation/setup interface to unauthenticated users. This allows an attacker to reinitialize the service and point it toward a malicious, attacker-controlled database, facilitating remote code execution.

This flaw carries a CVSS score of 9.1, reflecting its potential for total system compromise. Successful exploitation grants an attacker full control over the application's environment, leading to massive data exfiltration, loss of intellectual property, and severe reputational damage.

Immediate Action: Update Xerte Online Tools to version 3.14.6, 3.15.5, or the latest available release to close the installation interface access.

Proactive Monitoring: Monitor access logs for any requests directed toward the /setup/ directory and investigate unauthorized attempts to reconfigure the application.

Compensating Controls: Restrict access to the /setup/ directory at the web server level (e.g., via .htaccess or Nginx configuration) to prevent any external access to installation files.

Public Exploit Available: False

This vulnerability is highly critical due to its potential for full application takeover. Organizations should verify the status of their Xerte installation and ensure that access to setup directories is strictly controlled or removed entirely.