OpenCATS Import Module Arbitrary PHP Code Execution Vulnerability

OpenCATS, an open-source applicant tracking system and recruitment CRM, has an arbitrary PHP code execution vulnerability in its Import module.

Prior to version 0.10.0, the Import module in modules/import/ImportUI.php can preserve an uploaded file's original name for one import data type and place the file in the web-accessible temporary directory. An authenticated user with Import privileges can select the affected import path and upload a PHP file that remains under an attacker-controlled executable filename, and an import error can leave the file on disk.

• Affected versions: prior to 0.10.0.
• Preconditions: authenticated user with Import privileges; temporary directory served with PHP execution enabled.
• Impact: arbitrary PHP code execution with web server process privileges, exposing or modifying recruiting data and the host system.

This issue is fixed in version 0.10.0.