Unauthenticated PHP Code Injection in OpenCATS Installer

OpenCATS prior to commit 3002a29 contains a PHP code injection vulnerability in the installer AJAX endpoint that allows unauthenticated attackers to execute arbitrary code by injecting PHP statements into the databaseConnectivity action parameter. Attackers can break out of the define() string context in config.php using a single quote and statement separator to inject malicious PHP code that persists and executes on every subsequent page load when the installation wizard remains incomplete.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

OpenCATS, a popular open-source applicant tracking system, contains a critical PHP code injection vulnerability in its installer AJAX endpoint that allows unauthenticated attackers to execute arbitrary code. By injecting PHP statements into the databaseConnectivity action parameter, attackers can break out of the define() string context and inject malicious code that persists in config.php. This vulnerability is particularly dangerous because it executes on every subsequent page load as long as the installation wizard remains incomplete, giving attackers persistent code execution without authentication. Organizations running incomplete OpenCATS installations are at immediate risk of full system compromise, data theft, and lateral movement within their infrastructure.

Casky's security skills—powered by Claude AI's extended reasoning capabilities—would identify this attack pattern by correlating multiple indicators across the MITRE ATT&CK framework. Practitioners would see detections mapping to T1190 (Exploit Public-Facing Application) through analysis of suspicious AJAX requests to the installer endpoint with malformed parameters, and T1059 (Command and Scripting Interpreter) through identification of PHP code injection payloads containing quote escapes and statement separators. The platform's 754 mapped skills would flag the persistence mechanism—code injection into configuration files that executes on application startup—as a critical finding. Practitioners would receive context on the specific vulnerable parameter (databaseConnectivity), the attack preconditions (incomplete installation), and recommendations for immediate patching to commit 3002a29 or later.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-27760.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-27760

Casky has 301 skills that investigate the attack patterns behind CVE-2026-27760. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn