Description

Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values are written into the config.inc.php configuration file during installation through File::updateConfigFile() and DbInstall::dbControl(), combined with an SQL injection issue enabled by PDO::ATTR_EMULATE_PREPARES supporting stacked queries. Attackers can exploit the SQL injection to re-trigger the installer and inject arbitrary PHP code into config.inc.php, achieving unauthenticated remote code execution on the underlying system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-13T20:17:30.210Z",
  "pubdate": "2026-10-13T20:17:30.210Z",
  "executiveSummary": "Omnispace Agora Project versions prior to 26.10.0 are susceptible to a critical remote code execution (RCE) vulnerability stemming from the combination of code injection and SQL injection flaws.\nThe vulnerability resides within the application's installation and configuration logic, specifically involving the dynamic generation of the 'config.inc.php' file.\nAn unauthenticated, remote attacker can leverage an SQL injection vulnerability—facilitated by the use of PDO::ATTR_EMULATE_PREPARES—to execute stacked queries.\nBy manipulating the database, an attacker can re-trigger the installation process and inject arbitrary, attacker-controlled PHP code into the application's configuration file.\nThis chain of vulnerabilities allows for complete system compromise, enabling the execution of arbitrary commands with the privileges of the web server.\nThe risk is classified as critical due to the lack of required authentication, the ability to achieve full remote code execution, and the persistence gained through configuration file modification.",
  "technicalDetails": "The vulnerability originates from unsafe handling of configuration parameters during the installation process in the Omnispace Agora Project. The core issue lies within the 'File::updateConfigFile()' and 'DbInstall::dbControl()' functions, which fail to properly sanitize or escape input before writing values directly into 'config.inc.php'.\nThe exploitation path is enabled by a secondary vulnerability: an SQL injection flaw. The application utilizes PHP Data Objects (PDO) with 'PDO::ATTR_EMULATE_PREPARES' enabled. This configuration permits the execution of stacked queries (multiple SQL statements separated by semicolons), which is not natively supported by the underlying database driver when emulation is disabled. An attacker can craft malicious input to bypass validation and interact directly with the database via these stacked queries.\nThe attack flow proceeds as follows: First, the attacker exploits the SQL injection vulnerability during or after the installation phase to alter the application state. Second, the attacker triggers a re-execution of the installation workflow. By injecting malicious payloads into the database inputs that are subsequently processed by 'DbInstall::dbControl()', the attacker forces the application to write arbitrary PHP code into the 'config.inc.php' file via 'File::updateConfigFile()'.\nBecause the 'config.inc.php' file is included by the application during initialization, the injected PHP code is executed in the context of the web server process whenever the application is accessed. This results in unauthenticated remote code execution. The attacker requires no prior authentication, and the vulnerability is exploitable over the network.\nThe impact is total system compromise, as the attacker gains the ability to execute arbitrary commands, read or modify sensitive data, and maintain persistence on the server hosting the Omnispace Agora Project. Remediation requires ensuring that configuration writing functions strictly validate and escape inputs and that database interactions are secured against stacked query injection by disabling 'PDO::ATTR_EMULATE_PREPARES' and using true parameterized queries."
}