CVE-2024-1115

HIGH

openBI < 1.0.8 - OS Command Injection via phpPath Argument in Setting.php

Title source: llm
STIX 2.1

Description

A vulnerability was found in openBI up to 1.0.8 and classified as critical. This issue affects the function dlfile of the file /application/websocket/controller/Setting.php. The manipulation of the argument phpPath leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252473 was assigned to this vulnerability.

References (3)

Core 3
Core References
Third Party Advisory vdb-entry technical-description
https://vuldb.com/?id.252473
Permissions Required, Third Party Advisory signature permissions-required
https://vuldb.com/?ctiid.252473
Broken Link, Third Party Advisory broken-link exploit
https://note.zhaoj.in/share/81JmiyogcYL7

Scores

CVSS v3 7.3
EPSS 0.0187
EPSS Percentile 76.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-78
Status published
Products (1)
openbi/openbi < 1.0.8
Published Jan 31, 2024
Tracked Since Feb 18, 2026