Reportico Web Incorrect Access Control Leads to RCE

An incorrect access control vulnerability has been found in reportico-web versions up to and including 8.1.0.

An unauthenticated attacker can inject arbitrary PHP code into the PreExecuteCode attribute of any report, regardless of the safe_mode setting.

• Affected product: reportico-web <= 8.1.0
• Attack requirement: unauthenticated access
• Impact: remote code execution