Omnispace Agora Project Code Injection and SQL Injection Flaws Lead to RCE

Omnispace Agora Project before 26.10.0 contains a code injection vulnerability. Unescaped, attacker-controlled values are written into the config.inc.php configuration file during installation through File::updateConfigFile() and DbInstall::dbControl().

This is combined with an SQL injection issue enabled by PDO::ATTR_EMULATE_PREPARES supporting stacked queries. Attackers can exploit the SQL injection to re-trigger the installer and inject arbitrary PHP code into config.inc.php.

• Affected versions: before 26.10.0
• Attack requirement: unauthenticated
• Impact: remote code execution on the underlying system