Description
This module exploits an unauthenticated PHP code injection in the OpenCATS installer AJAX endpoint (CVE-2026-27760).
The databaseConnectivity action passes the user POST parameter directly to changeConfigSetting(), which interpolates it into a define() statement in config.php without any sanitization. This only works when the installation wizard was never completed, meaning the INSTALL_BLOCK file is absent.
The exploit injects an eval() backdoor into config.php, probes until the injected code is live (handles OPcache revalidation transparently), triggers the payload via index.php, and then restores config.php.
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/multi/http/opencats/installer_rcemsf undefined(installer_rce) > show actions ...actions...msf undefined(installer_rce) > set ACTION < action-name >msf undefined(installer_rce) > show options ...show and set options...msf undefined(installer_rce) > runPrioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub