A recent analysis uncovered an OS command injection vulnerability in the Great Developers Certificate Generation System, specifically in the /restructured/csv.php file. The flaw arises when the 'photo' argument is manipulated, allowing an attacker to inject and execute arbitrary operating‑system commands on the host running the application. This type of weakness permits complete compromise of the system, giving the attacker full control over confidentiality, integrity, and availability.

The affected product is the Great Developers Certificate Generation System, deployed by the vendor Great Developers. The vulnerable code path is the /restructured/csv.php file, and all versions up to commit 97171bb0e5e22e52eacf4e4fa81773e5f3cffb73 are potentially affected. The product uses a rolling release model, and the code repository has not been maintained for several years, so updated or patched releases are currently unavailable.

The CVSS base score of 6.9 indicates a medium severity vulnerability, but the associated EPSS score of less than 1% shows a very low probability of exploitation in the wild. The strength of the attack is remote, requiring only that the victim browse or submit a request to the compromised endpoint. While the vulnerability is not listed in the CISA KEV catalog, the lack of an official fix and ongoing maintenance uncertainty elevate the risk, necessitating immediate mitigation actions.