The vulnerability is a PHP code injection flaw (CWE-94) in the OpenCATS installer AJAX endpoint. An unauthenticated attacker can send a specially crafted payload in the databaseConnectivity action parameter to write malicious PHP code into its configuration files. Because the injected code is executed each time the installer wizard is not yet finished, the page loads.

All installations of OpenCATS derived from the code base before commit 3002a29f4c3cada1aa2c4f3d4ae4e189906606b6 are impacted. No specific version numbers are listed, so any OpenCATS deployment prior to this update carries the vulnerability.

The CVSS score of 9.2 classifies the flaw as critical, and the EPSS score of 24% indicates a moderate likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, but attackers only need HTTP access to the installer AJAX endpoint. It is inferred that the attacker can send a crafted HTTP POST request without authentication to perform the injection, resulting in execution of malicious PHP code on every subsequent request until the installation wizard is completed.