CVE-2024-1198: openBI Phar User.php addxinzhi deserialization

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-03 · updated 2026-06-17
Weakness: CWE-502

Description

A vulnerability, which was classified as critical, was found in openBI up to 6.0.3. Affected is the function addxinzhi of the file application/controllers/User.php of the component Phar Handler. The manipulation of the argument outimgurl leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252696.

Affected products

openBI: from 6.0.0 through 6.0.3

References

https://note.zhaoj.in/share/qFXZZfp1NLa3
https://vuldb.com/?ctiid.252696
https://vuldb.com/?id.252696
https://note.zhaoj.in/share/qFXZZfp1NLa3
https://vuldb.com/?ctiid.252696
https://vuldb.com/?id.252696

Get alerted when CVE-2024-1198 or the next vulnerability affects your stack