OpenXDMoD `user_interface.php` Report Title Command Injection (CVE-2026-45777)

Metadata

Affected Target

Summary

Open XDMoD’s controllers/user_interface.php endpoint accepts a report title parameter as part of a PDF report generation request. The PoC demonstrates that this value is passed unsanitized into a server-side command execution context (used during PDF/report rendering), allowing an unauthenticated request marked public_user=true to break out of the expected title string and inject arbitrary shell commands. The included Python script sends a single crafted POST request containing a shell metacharacter payload embedded in the title field and prints the server’s response, demonstrating command execution as part of report generation.

Vulnerability Details

Root Cause

The title field submitted to controllers/user_interface.php for report data generation (operation=get_data, format=pdf) is concatenated into a command/string that is later executed or interpreted by the server without proper sanitization or escaping, allowing injection of shell metacharacters ('; <command>; #) to append arbitrary OS commands.

Attack Vector

1. Attacker sends an HTTP POST request to https://<target>/controllers/user_interface.php with form-encoded parameters: public_user=true, realm=Jobs, start_date, end_date, format=pdf, operation=get_data.
2. The title parameter is set to a payload of the form '; <attacker_command>; #, breaking out of the expected quoting/context.
3. The server processes the report generation request and executes the injected command in the context of the web application/report-rendering process.
4. The response (and/or generated report artifact) may reflect command output, confirming code execution.

Impact

Unauthenticated remote command execution on the host running Open XDMoD, potentially leading to full system compromise, data exfiltration (institutional job/usage metrics data), or lateral movement within the hosting environment.

Environment / Lab Setup

Target: Open XDMoD instance (version per source repository), reachable over HTTPS
Attacker tooling: Python 3 with the `requests` library
No authentication needed — request is sent with public_user=true

Proof of Concept

PoC Script

See CVE-2026-45777.py in this folder.

1
2

python3 CVE-2026-45777.py <target_host:port> "<os_command>"
python3 CVE-2026-45777.py 127.0.0.1:8080 "id"

Running the script sends a crafted POST request to /controllers/user_interface.php with the OS command embedded in the title field of a PDF report request; the server’s response is printed, and successful exploitation shows the output of the injected command reflected back.

Detection & Indicators of Compromise

- POST requests to /controllers/user_interface.php with public_user=true and format=pdf
- title parameter values containing shell metacharacters such as ' ; # | & $( ) `
- Unexpected child processes spawned by the web server / PHP-FPM process handling XDMoD report generation
- Anomalous outbound connections or file writes originating from the XDMoD report-generation service

Signs of compromise:

• Unusual entries in web server access logs referencing user_interface.php with operation=get_data and abnormal title values.
• Unexpected shell processes (e.g., sh -c, bash -c) spawned by the web server user around report generation requests.
• Presence of unfamiliar files, reverse shells, or webshells dropped in the Open XDMoD web root or temp/report directories.

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/morepoints/CVE-2026-45777 on 2026-07-05.