critical9.8Public exploit code
CVE-2024-22836
An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Akaunting < 3.1.3 - RCE2024-03-10 · webapps · php
Impact
An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. An attacker can manipulate the company locale when installing an app to execute system commands on the hosting server.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Akaunting | Akaunting | before 3.1.4 |