Opencode Mobile Collect Call PHP Code Injection Vulnerability Allowing Remote Code Execution and XSS

A PHP code injection vulnerability has been identified in Opencode Mobile Collect Call version 5.4.7. This vulnerability allows attackers to execute arbitrary PHP code, leading to remote code execution (RCE) and cross-site scripting (XSS) attacks. The issue arises in the 'op_func' parameter of the '/occontrolpanel/index.php' endpoint, where crafted payloads can be injected to execute malicious scripts or HTML.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server, with the executed code running in the context of the web server user. Additionally, it enables cross-site scripting attacks by injecting malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a request to the '/occontrolpanel/index.php' endpoint with a payload injected into the 'op_func' parameter. The injected payload can be a PHP function, such as 'sleep()', to demonstrate code execution. Once the payload is executed, it is possible to write files, read sensitive files like '/etc/passwd', or execute XSS payloads that are injected and executed in the user's browser.

Remediation

It is recommended to validate and sanitize user inputs, disable dangerous PHP functions such as 'eval()' and 'create_function()', and secure file permissions to restrict write access to critical directories.