A ready-made attack for a flaw in sergejey MajorDoMo is now public
KROMSE explanation
sergejey MajorDoMo has a security flaw (CVE-2026-27175, CVSS 9.2). The official record says: MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated OS command injection via rc/index.php. The $param variable from user input is interpolated into a command string within double quotes without sanitization via escapeshellarg().
Not confirmed yet, but attack code is public, so attacks often follow within days.
Anyone running sergejey MajorDoMo.
- Install the maker's update for sergejey MajorDoMo as soon as it is out.
- Not sure if you use it? KROMSE can check your product for free.
