A PHP-based instance of CryptoLog is vulnerable to an unauthenticated remote code execution (RCE) attack that chains two separate weaknesses. An attacker can inject a malicious SQL statement into the user field of login.php, bypassing authentication and achieving session establishment. With this foothold, the attacker targets the lsid parameter of logshares_ajax.php, exploiting a command injection vulnerability that allows the execution of arbitrary operating system commands using the $(...) syntax. The result is that the attacker obtains a shell running as the web server user, compromising confidentiality, integrity, and availability of the affected system. The weakness is driven by input validation failures (CWE‑20), lack of authentication (CWE‑306), dangerous command execution (CWE‑78), and SQL injection (CWE‑89).

Crypttech CryptoLog (PHP version, discontinued since 2009) is affected, specifically the login.php and logshares_ajax.php endpoints. No specific version numbers are listed beyond the general PHP edition of CryptoLog.

The CVSS score of 9.3 reflects the high severity of the vulnerability, and the EPSS score of 60% indicates that exploitation is fairly likely in the wild. Although the vulnerability is not currently listed in the CISA KEV catalog, its high likelihood of exploitation and the ability for attackers to gain server-level access present a significant risk. The attack vector is web-based and requires no authentication, making it attractive to automated exploit tools.