O-CMS 1.0.0 Authenticated OS Command Injection via ai_cli_script
O-CMS 1.0.0 has an authenticated OS command injection in the ai_cli_script parameter, letting privileged attackers execute arbitrary commands.
O-CMS version 1.0.0 contains an authenticated OS command injection vulnerability in its AI CLI configuration functionality. An authenticated attacker with sufficient privileges can supply shell metacharacters and extra commands through the ai_cli_script parameter of /admin/settings/save. The attacker-controlled CLI value is then executed when the configured AI provider is tested via /admin/settings/test-ai.
22