{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aomnispaceagora_project/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:omnispace:agora_project:*:*:*:*:*:*:*:*"],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Agora Project (\u003c 26.10.0)"],"_cs_severities":["critical"],"_cs_tags":["remote-code-execution","sql-injection","web-application-vulnerability"],"_cs_type":"advisory","_cs_vendors":["Omnispace"],"content_html":"\u003cp\u003eOmnispace Agora Project versions before 26.10.0 contain a critical code injection vulnerability (CVE-2026-63146) that allows unauthenticated remote code execution (RCE). The vulnerability stems from improper sanitization during the application installation process within the File::updateConfigFile() and DbInstall::dbControl() functions. Attackers can leverage an underlying SQL injection vulnerability enabled by PDO::ATTR_EMULATE_PREPARES, which supports stacked queries. By executing stacked SQL queries, an attacker can trigger the re-installation workflow of the application and inject arbitrary PHP code directly into the config.inc.php configuration file. This vulnerability is particularly dangerous as it provides a pathway for an unauthenticated user to achieve full control over the application and the underlying server environment.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full remote code execution, granting attackers the ability to run arbitrary system commands, exfiltrate sensitive data, or establish persistence on the host server. The vulnerability carries a CVSS v3.1 base score of 9.8, reflecting the ease of exploitation and the critical nature of the impact. Any server running an affected version of Agora Project is at risk of total compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for security and IT operations teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all instances of Omnispace Agora Project to version 26.10.0 or later immediately to patch CVE-2026-63146.\u003c/li\u003e\n\u003cli\u003eReview the config.inc.php file on all accessible web servers for unauthorized PHP code or unexpected changes.\u003c/li\u003e\n\u003cli\u003eDisable PDO::ATTR_EMULATE_PREPARES in database connection configurations if the application logic permits, to mitigate the feasibility of stacked query-based SQL injection.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-13T20:43:51Z","date_published":"2026-10-13T20:43:51Z","id":"https://feed.craftedsignal.io/briefs/2026-10-omnispace-agora-rce/","summary":"Omnispace Agora Project versions prior to 26.10.0 are vulnerable to unauthenticated remote code execution due to chained SQL injection and configuration file injection.","title":"Remote Code Execution in Omnispace Agora Project via CVE-2026-63146","url":"https://feed.craftedsignal.io/briefs/2026-10-omnispace-agora-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:omnispace:agora_project:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}