CyberRota Analysis
AI-GeneratedAkaunting versions prior to 2.1.31 are susceptible to an OS command injection vulnerability that allows authenticated users with admin panel access to exploit the alias parameter, enabling the execution of arbitrary shell commands on the server. This high-severity flaw poses a significant risk to system integrity and confidentiality. Organizations using affected versions should prioritize patching to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to execute arbitrary commands on the server.