H00Die-Gr3Y

**Name of the Vulnerable Software and Affected Versions** OTRS Community Edition (affected versions not specified) **Description** An authenticated OS command injection exists in the PGP encryption module. This issue occurs because configuration values provided by administrators are concatenated into a shell command without proper sanitization. An attacker with administrator privileges can execute arbitrary operating-system commands as the web server process user by supplying crafted values for the PGP binary path and command options during normal ticket operations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** openITCOCKPIT Community Edition versions prior to 5.5.2 **Description** An authenticated user with permissions to add or modify hosts can execute arbitrary OS commands on the monitoring backend. This occurs because user-controlled host attributes, specifically the host address, are expanded into monitoring command templates without proper validation, escaping, or quoting. These templates are subsequently executed by the monitoring engine (Nagios/Icinga) via a shell, leading to remote code execution. **Recommendations** Update to version 5.5.2.

**Name of the Vulnerable Software and Affected Versions** FreePBX versions 16.0.17.2 through 16.0.20 FreePBX versions 17.0.2.4 through 17.0.5 **Description** FreePBX, an open source IP PBX, contains a command injection issue within the recordings module when utilizing the ElevenLabs Text-to-Speech (TTS) engine. The issue allows for potential unauthorized command execution. **Recommendations** Update to FreePBX version 16.0.20 or later. Update to FreePBX version 17.0.5 or later.

**Name of the Vulnerable Software and Affected Versions** FreePBX versions 16.0.17.2 through 16.0.19 FreePBX versions 17.0.2.4 through 17.0.4 **Description** FreePBX is an open source IP PBX. Multiple command injection vulnerabilities exist in the recordings module. These issues have been addressed in later releases. The vulnerabilities allow for potential unauthorized command execution. The affected module is the recordings module. **Recommendations** Update to FreePBX version 16.0.20 or later. Update to FreePBX version 17.0.5 or later.

**Name of the Vulnerable Software and Affected Versions** openITCOCKPIT Community Edition versions prior to 5.3.1 **Description** openITCOCKPIT is a monitoring tool compatible with Nagios, Naemon, and Prometheus. The software contains an unsafe PHP deserialization pattern when handling changelog entries. Specifically, serialized changelog data originating from attacker-controlled application state is deserialized without class restrictions. While no current application endpoint directly introduces PHP objects into this data path, the unrestricted use of `unserialize()` creates a potential PHP object injection issue. Future modifications, plugins, or refactoring that introduce object values into this path could lead to immediate exploitability, potentially resulting in remote code execution. **Recommendations** Update to a version newer than 5.3.1.

**Name of the Vulnerable Software and Affected Versions** openITCOCKPIT versions 5.3.1 and below **Description** openITCOCKPIT, an open source monitoring tool, has an unsafe deserialization issue in the Gearman worker implementation. The `oitc gearman` function uses PHP’s `unserialize()` on job payloads without proper restrictions or validation. This allows an attacker to potentially trigger PHP Object Injection if they can submit crafted serialized payloads to the Gearman service, especially when Gearman listens on non-local interfaces or network access to TCP/4730 is unrestricted. The issue persists regardless of deployment configuration, as the trust boundary is not enforced in the application code. **Recommendations** Upgrade to version 5.4.0 or later.

**Name of the Vulnerable Software and Affected Versions** Centreon Infra Monitoring versions 25.10.0 through 25.10.1 Centreon Infra Monitoring versions 24.10.0 through 24.10.14 Centreon Infra Monitoring versions 24.04.0 through 24.04.18 **Description** A flaw exists in the backup parameters of Centreon Infra Monitoring where a user with high privileges can append custom instructions to the backup configuration. This can lead to OS Command Injection due to improper neutralization of special elements used in OS commands. The issue is present in the backup configuration within the administration setup modules. **Recommendations** Update Centreon Infra Monitoring to version 25.10.2 or later. Update Centreon Infra Monitoring to version 24.10.15 or later. Update Centreon Infra Monitoring to version 24.04.19 or later.

**Name of the Vulnerable Software and Affected Versions** centreon-web versions 23.10.0 through 23.10.23 centreon-web versions 24.04.0 through 24.04.14 centreon-web versions 24.10.0 through 24.10.8 centreon-web version 25.03 **Description** The issue is related to an OS Command Injection vulnerability due to the improper neutralization of special elements used in an OS command. This vulnerability affects the Backup configuration modules in centreon-web. **Recommendations** For centreon-web versions 23.10.0 through 23.10.23, update to version 23.10.24 or later. For centreon-web versions 24.04.0 through 24.04.14, update to version 24.04.15 or later. For centreon-web versions 24.10.0 through 24.10.8, update to version 24.10.9 or later. For centreon-web version 25.03, update to a version later than 25.03.

**Name of the Vulnerable Software and Affected Versions** Pandora ITSM version 5.0.105 **Description** The issue is related to the improper neutralization of special elements in the `chromium path` variable, which may allow OS command injection. **Recommendations** For Pandora ITSM version 5.0.105, consider restricting access to the `chromium path` variable to minimize the risk of OS command injection until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Pandora ITSM version 5.0.105 **Description** The issue is related to the improper neutralization of special elements in the backup name field, which may allow OS command injection. **Recommendations** For Pandora ITSM version 5.0.105, update to a version that fixes the improper neutralization of special elements in the backup name field to prevent OS command injection.