The exposed installer AJAX endpoint allows an unauthenticated attacker to inject PHP code via the databaseConnectivity action parameter. By inserting a single quote and statement separator, the attacker can break out of the define() string context in config.php and embed malicious PHP that is written to the files used by the application. Once injected, the code persists and executes on every page load while the installation wizard remains incomplete, giving the attacker full control to run arbitrary commands, exfiltrate data, and establish back‑doors.

All installations of OpenCATS running a code base prior to the commit that introduced the fix (commit 3002a29f4c3cada1aa2c4f3d4ae4e189906606b6) are affected. No specific version numbers are listed, so any deployment of OpenCATS before this update carries the vulnerability.

The CVSS score of 9.2 classifies this as a Severe vulnerability. The EPSS score is not available, but the lack of a KEV listing does not reduce the risk of exploitation. Attackers need only HTTP access to the site; no authentication is required to reach the AJAX endpoint. By supplying a crafted payload in the databaseConnectivity action, they can inject PHP that survives consecutive requests until the installer wizard is completed, thereby achieving remote code execution.