# Vulnerability Summary ## Vulnerability Overview OpenCATS contains a security vulnerability that allows attackers to perform unauthorized operations via AJAX requests during the upgrade process, potentially leading to a configuration write vulnerability. ## Scope of Impact - When upgrade mode is active, `INSTALL_BLOCK` is missing. - `ajax.php` only permits installer AJAX operations (`install.*`); other AJAX requests are rejected. - When the installer writes configuration to `modules/install/ajax/ui.php`, string values are passed directly to `CATUtility::changeConfigSetting()` without escaping, creating potential security risks. ## Remediation 1. **Restrict AJAX Requests**: - In upgrade mode, only installer AJAX operations (`install.*`) are allowed. - Other AJAX requests are rejected with a standard XML error response. 2. **Escape Configuration Writes**: - In `modules/install/ajax/ui.php`, escape string values before passing them to `CATUtility::changeConfigSetting()`. - Use `var_export($value, true)` instead of directly concatenating raw input. 3. **Additional Recommendations**: - Apply secure escaping to the following configuration paths: - `DATABASE_USER` - `DATABASE_PASS` - `DATABASE_HOST` - `DATABASE_NAME` - `MAIL_SENDMAIL_PATH` - `MAIL_SMTP_HOST` - `MAIL_SMTP_USER` - `MAIL_SMTP_PASS` - `ANTIVIRUS_PATH` - `POP3TEXT_PATH` - `HTMLTEXT_PATH` - `UNWIR_PATH` ## POC Code ```php // Before fix CATUtility::changeConfigSetting($key, $value); // After fix CATUtility::changeConfigSetting($key, var_export($value, true)); ```