4Mosan Gcb Doctor
Monthly
OS command injection in 4MOSAn GCB Doctor allows unauthenticated remote attackers to execute arbitrary system commands via a leftover ADOdb test page whose parameter is passed into a shell context. The vulnerable component is a debug/test artifact (an ADOdb connection test page) that was never removed from production builds, so any internet-reachable instance before build 20260621 is exploitable with a single crafted request. No public exploit has been identified at time of analysis, but the CVSS 4.0 base score of 9.3 and the fully unauthenticated network vector make this a high-priority patch.
OS command injection in 4MOSAn GCB Doctor allows unauthenticated remote attackers to execute arbitrary system commands via a leftover ADOdb test page whose parameter is passed into a shell context. The vulnerable component is a debug/test artifact (an ADOdb connection test page) that was never removed from production builds, so any internet-reachable instance before build 20260621 is exploitable with a single crafted request. No public exploit has been identified at time of analysis, but the CVSS 4.0 base score of 9.3 and the fully unauthenticated network vector make this a high-priority patch.