Executive brief
A vulnerability exists in vps-inventory-monitoring, a tool used to track VPS stock levels. An attacker with a standard user account can inject malicious code into the system's monitoring settings. When the system performs its scheduled inventory checks, this code is executed, potentially allowing the attacker to take full control of the server, access sensitive data, or disrupt operations.
Technical details
A code injection vulnerability exists in the VpsTest Console component of vps-inventory-monitoring due to the unsafe use of the PHP eval() function. The root cause is located in app/index/command/VpsTest.php, which retrieves user-controlled input from the 'vf' (validation function) column of the database and executes it directly. An authenticated attacker can submit a malicious PHP payload via the 'POST /index/index/edit' endpoint. This code is subsequently executed when the 'php think VpsTest' command is run, either manually by an administrator or via a scheduled cron job. Successful exploitation allows for remote code execution (RCE) with the privileges of the user running the task. As of the advisory date, no official patch has been released by the vendor.
Affected products
- 546669204 vps-inventory-monitoring up to 98c00b370668c96ae75e91c15548d9ea113652d9
Timeline
- 2026-04-24: disclosed: Initial disclosure on GitHub by dntyfate
- 2026-05-23: advisory: VulDB advisory published