CVE-2024-5407 is a Critical (CVSS 10.0) PHP code injection flaw in RhinOS 3.0-1190, a web application from the SALTOS project. The record says the search parameter on the portal search page can be abused by a remote attacker to run code on the server. I could not confirm a fixed version, so check the maintainer's advisory.
What's affected
- Product: RhinOS, from the SALTOS project. The source lives in the josepsanzcamp/RhinOS repository.
- Affected version: 3.0-1190, the only build the record lists.
- Fixed version: not stated in the record. The INCIBE notice linked from it rejected my request, and the GitHub repository describes itself as the nightly source, with no release number I could tie to this CVE. Do not assume a newer nightly is fixed without reading the notice.
- Severity: Critical, CVSS 10.0. The vector is network based, needs no privileges and no user interaction, and the scope changes, which is how a score reaches 10.0.
- Exploitation: the record's KEV flag is false. No source I read reports exploitation.
How to check if you're exposed
First, find out whether you run RhinOS at all. Look for the application in your web server inventory, and for the portal search page that the record names. If the build string shows 3.0-1190, treat the host as affected.
Next, look at how the host is exposed. An internet facing portal is the urgent case. Review web server logs for unusual requests to the search page, such as very long values or values that contain PHP syntax. Do this as a review, not as a test against production.
INCIBE's notice title refers to multiple vulnerabilities in RhinOS, so read it fully for the other issues and the recommended action for each.
What to do now
- List all hosts running RhinOS and record the exact build.
- Read the INCIBE notice and the project repository for the fixed build, and upgrade to it. If none is documented, contact the maintainer.
- Until you can patch, restrict access to the portal, or place a web application firewall rule in front of the search page that blocks PHP syntax in that parameter.
- Check the server for files or accounts you did not create, since the record describes full compromise of the host.
- Rotate credentials stored on the server, including database and API keys, if you find signs of tampering.
Why it matters
The record maps this to CWE-94, improper control of code generation. User input reaches a place where the application treats it as PHP source instead of data. Anything a visitor types into the search box then has a path to the interpreter.
The record's own wording is that an attacker could open a reverse shell and compromise the entire infrastructure. That is the account of the issue in the record, not a confirmed incident. A flaw like this on a public page with no login is the kind that scanners find quickly once details are public, so exposed hosts should be treated as a priority even without a KEV listing.
Quick check
Do I need an account to reach the vulnerable page?
The vector shows no privileges required (PR:N), so a search request from an unauthenticated visitor is the described entry point.
Is a fixed release available?
I could not confirm one. Check the INCIBE notice and the RhinOS repository, and contact the maintainer if neither names a build.
Sources
- RhinOS source repository on GitHub
- INCIBE notice on multiple vulnerabilities in RhinOS (did not load for me, so its contents are not used here)
- NVD record data for CVE-2024-5407, as supplied in the batch record
Last reviewed: 19 October 2026.
