{"uuid": "ed68d8d5-1bf5-4c56-a40c-15a8d811955f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27760", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/opencats_installer_rce.rb", "content": "{\"aliases\": [], \"arch\": \"php, cmd, x64, x86, aarch64\", \"author\": [\"Chocapikk\", \"stlthr4k3r\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an unauthenticated PHP code injection in the OpenCATS\\n          installer AJAX endpoint (CVE-2026-27760).\\n\\n          The databaseConnectivity action passes the user POST parameter directly to\\n          changeConfigSetting(), which interpolates it into a define() statement in\\n          config.php without any sanitization. This only works when the installation\\n          wizard was never completed, meaning the INSTALL_BLOCK file is absent.\\n\\n          The exploit injects an eval() backdoor into config.php, probes until the\\n          injected code is live (handles OPcache revalidation transparently), triggers\\n          the payload via index.php, and then restores config.php.\", \"disclosure_date\": \"2026-04-28\", \"fullname\": \"exploit/multi/http/opencats_installer_rce\", \"is_install_path\": true, \"mod_time\": \"2026-08-03 17:18:13 +0000\", \"name\": \"OpenCATS Installer PHP Code Injection\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\", \"config-changes\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/opencats_installer_rce.rb\", \"platform\": \"Linux,PHP,Unix,Windows\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"multi/http/opencats_installer_rce\", \"references\": [\"CVE-2026-27760\", \"URL-https://chocapikk.com/posts/2026/opencats-installer-rce/\", \"URL-https://github.com/opencats/OpenCATS/commit/3002a29f4c3cada1aa2c4f3d4ae4e189906606b6\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"PHP In-Memory\", \"Unix/Linux Command\", \"Windows Command\", \"Linux Dropper\", \"Windows Dropper\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:05.484205Z"}