Agora Project CVE-2026-63146

Exploitation requires a reachable Agora Project instance running a version before 26.10.0 whose database layer uses PDO with ATTR_EMULATE_PREPARES enabled (the default that permits stacked queries), allowing the SQL injection to re-invoke the installer; the installer code paths File::updateConfigFile() and DbInstall::dbControl() must be reachable to write unescaped attacker input into config.inc.php. No authentication, privileges, or user interaction are required per the CVSS vector (PR:N/UI:N), so default internet-facing deployments are exploitable. The principal limiting factor is exposure and version: patched instances (26.10.0+) and non-internet-facing deployments are not at risk.

All available signals point to a genuine high-priority vulnerability rather than an inflated high-CVSS issue. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, base 9.3) describes a network-reachable, low-complexity, unauthenticated attack with no user interaction yielding full confidentiality, integrity, and availability impact - consistent with the description's claim of unauthenticated remote code execution via a chained SQL injection and PHP code injection. The attack vector and complexity are internally consistent with the described exploitation (web-facing PHP application, SQLi re-triggering the installer), so no contradiction between vector and narrative is apparent. However, key exploitation signals are MISSING: there is no EPSS score, no CISA KEV listing, and no indication of public exploit code in the provided data - so exploitation remains theoretical at time of analysis despite the severe technical impact. The chained nature (SQLi enabled by PDO::ATTR_EMULATE_PREPARES stacked-query support, then config-file code injection) is well-understood and reproducible by a skilled attacker, which raises the practical likelihood of a POC emerging. Net assessment: patch urgently where deployed, but the realistic blast radius is bounded by the product's limited deployment footprint rather than by any mitigating technical factor.

A remote, unauthenticated attacker sends a crafted request to an internet-facing Agora Project instance, abusing the stacked-query SQL injection (permitted by PDO::ATTR_EMULATE_PREPARES) to re-trigger the installation routine. Because File::updateConfigFile() and DbInstall::dbControl() write unescaped attacker-controlled values into config.inc.php, the attacker injects arbitrary PHP that executes on the next request, yielding full server compromise. No public exploit code is identified at time of analysis, but the described chain is straightforward to weaponize.