EXPOSURES › CVE-2026-63146
CVE-2026-63146
CRITICALOmnispace Agora Project before 26.10.0 allows unauthenticated remote code execution via SQL injection during installation.
During installation, unescaped attacker-controlled values are written to config.inc.php, and an SQL injection vulnerability enabled by PDO::ATTR_EMULATE_PREPARES allows stacked queries. Attackers can re-trigger the installer to inject arbitrary PHP code, achieving unauthenticated remote code execution on the underlying system. DIB organizations must ensure all software is patched to the latest version and validate installation processes to prevent similar exploits.
Shame score — A critical unauthenticated remote code execution vulnerability in a project before version 26.10.0, indicating a severe failure in secure coding practices and patch management.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values are written into the config.inc.php configuration file during installation through File::updateConfigFile() and DbInstall::dbControl(), combined with an SQL injection issue enabled by PDO::ATTR_EMULATE_PREPARES supporting stacked queries. Attackers can exploit the SQL injection to re-trigger the installer and inject arbitrary PHP code into config.inc.php, achieving unauthenticated remote code execution on the underlying system.