Executive brief
Wavelog is web-based amateur radio logging software. After installation, the installer remains accessible and exposes administrative AJAX endpoints that accept unsanitized input, allowing unauthenticated attackers to read/write configuration files and inject malicious PHP code. An attacker can exploit this to execute arbitrary code on the server, potentially gaining full system compromise without requiring authentication.
Technical details
The vulnerability exists in /install/ajax.php and /install/includes/interface_assets/triggers.php, which are exposed after installation without an installation lock or permission checks. Unsanitized user input reaches write_config() and write_configfile() functions in install/includes/core/core_class.php, allowing arbitrary data to be written to PHP configuration files. An unauthenticated remote attacker can exploit this via HTTP requests to inject PHP code into configuration files that are subsequently executed on the server. The fix, implemented in version 2.4.2, introduces an installation lock file (.lock), token-based authentication (HTTP_X_INSTALLER_TOKEN header), and proper input validation to prevent this attack.
Affected products
- Wavelog Wavelog 1.8 to 2.4.1
Timeline
- 2026-09-17: disclosed
- 2026-05-08: patched: Version 2.4.2 released with security fixes