CVE-2026-2944 Details
Description
A security flaw has been discovered in Tosei Online Store Management System ネット店舗管理システム 1.01. Affected is the function system of the file /cgi-bin/monitor.php of the component HTTP POST Request Handler. Performing a manipulation of the argument DevId results in os command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
A remote code execution vulnerability has been identified in Tosei Online Store Management System version 1.01. The issue arises in the '/cgi-bin/monitor.php' file, specifically within the HTTP POST request handler. The vulnerability is caused by improper input validation of the 'DevId' parameter, which allows for OS command injection. Exploitation can be achieved by sending a crafted POST request that manipulates the 'DevId' argument, leading to the execution of arbitrary commands on the server.
It is recommended to implement proper input validation for the 'DevId' parameter, ensuring it only accepts alphanumeric characters. If shell command execution is necessary, use PHP's 'escapeshellarg()' function to sanitize the input. Regular security audits should also be conducted to identify and address potential vulnerabilities.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/CVE-Hunter-Leo/CVE/issues/9 | [email protected] | ExploitIssue TrackingThird Party Advisory |
| https://vuldb.com/?ctiid.347314 | [email protected] | Permissions RequiredVDB Entry |
| https://vuldb.com/?id.347314 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/?submit.754579 | [email protected] | Third Party AdvisoryVDB Entry |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | [email protected] |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| tosei-corporation online store management system | 1.01 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Feb 26, 2026 | Initial Analysis | [email protected] |
| Feb 22, 2026 | New CVE Received | [email protected] |