A flaw was discovered in version 1.01 of Tosei Online Store Management System. Manipulating the DevId parameter in the HTTP POST request handler /cgi-bin/monitor.php enables an attacker to inject arbitrary operating‑system commands. Successful exploitation grants the attacker remote code execution on the underlying web server, allowing full compromise of the system, including data exfiltration, modification, or disruption of service. The vulnerability is a classic command injection flaw (CWE‑77 / CWE‑78) that takes place when untrusted user data is passed directly to a shell execution function without proper sanitization. An attacker can trigger the vulnerability from any remote host that can send HTTP POST requests to the endpoint, potentially without authentication.

The affected product is Tosei:Online Store Management System ネット店舗管理システム, with the vulnerable release identified as version 1.01. No other versions or sub‑components were listed as affected in the vendor‑provided data.

The CVSS score of 6.9 indicates a high‑medium severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild at the time of this analysis. Nonetheless, the exploit has been publicly released and the exploit code is available, so the risk for active attackers is significant. The vulnerability does not appear in the CISA KEV catalog. The likely attack vector is a remote HTTP POST request to the /cgi-bin/monitor.php endpoint, which a public attacker could use from any location with network reachability to the web server.