An unauthenticated remote code execution vulnerability exists in the OpenCATS installer, posing a critical risk to systems where the installation wizard has not been finalized.

This is a code injection (CWE-94) flaw within the installer AJAX endpoint. Unauthenticated attackers can inject malicious PHP code into the config.php file by manipulating the databaseConnectivity action parameter, which executes upon subsequent page loads.

Successful exploitation of this vulnerability allows an unauthenticated attacker to achieve full remote code execution on the underlying server. This grants the attacker complete control over the application, enabling them to steal sensitive recruitment data, modify system configurations, or pivot to other internal network resources. Given the CVSS score of 8.1, this represents a high-severity risk to system integrity and data confidentiality.

Immediate Action: Upgrade to the latest version of OpenCATS or apply the fix provided in commit 3002a29f4c3cada1aa2c4f3d4ae4e189906606b6. If an immediate upgrade is not possible, ensure the installation process is finalized and an INSTALL_BLOCK file is present to disable the vulnerable endpoint.

Proactive Monitoring: Review web server access logs for anomalous requests to the /ajax.php endpoint, specifically looking for attempts to pass arbitrary PHP syntax in parameters. Monitor for unexpected modifications to the config.php file.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing common PHP injection patterns or suspicious characters within the installer AJAX parameters. Restrict access to the installation directory at the network or server level if the installation has already been completed.

Public Exploit Available: Yes, a Metasploit module and Nuclei detection template exist.

This vulnerability presents a severe risk due to the ability for unauthenticated actors to gain system-level access. Administrators must prioritize applying the identified patch or ensuring the installation process is fully locked down to prevent unauthorized access to the installer endpoint. Failure to secure this component could lead to full system compromise.