# Prompt Injection - Aidex Chat API Command Execution Attempt

- **Severity:** Critical
- **Signature ID:** `6f2a1d3c-8e47-4b1a-9c2d-5f8b3a7e1d4c`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** LLM01 (Prompt Injection)

## Summary

Aidex is a chat product with a backend API. In versions before 1.7, text sent in a chat message can be crafted so the backend treats it as something to execute instead of just chat content, running system commands or internal framework functions.

## How the attack works

An authenticated user sends a message to Aidex's chat endpoint. Instead of normal conversation text, the message content includes shell commands, PHP/MySQL function calls, or Laravel/Symfony framework primitives like Artisan::call, DB::select, or the Symfony Process component. If the backend fails to sanitize this content, it executes the embedded commands or calls rather than treating them as inert text. This gives the attacker a path to run arbitrary OS commands or invoke privileged application internals from a normal-looking chat message.

## Why it matters

An attacker with a valid Aidex account could execute operating system commands or backend framework functions on the server, potentially leading to data theft, further compromise of the host, or unauthorized database access.

## What you can do

- Upgrade Aidex to version 1.7 or later where this issue is addressed, if available.
- Restrict which authenticated accounts can reach the /api/<chat>/message endpoint, and monitor its use for anomalous payloads.
- Review chat content server-side for shell command syntax, backticks, or framework call patterns before it reaches any execution path.
- Treat alerts as a starting point for investigation, not proof of compromise — legitimate coding-assistant conversations about exec(), Artisan::call(), or shell snippets can look similar.

## Known benign look-alikes

- Developers using Aidex's coding-assistant chat to review or debug their own PHP scripts that legitimately call exec()/shell_exec()/system()/passthru()
- Support or onboarding conversations explaining Laravel Artisan::call(), DB::select(), or the Symfony Process component as part of normal documentation Q&A
- Users pasting Stack-Overflow-style snippets with backticked shell commands (e.g. `whoami`, `cat file`) while asking "what does this script do"
- Authorized security/QA testing of the /message endpoint with crafted payloads during a sanctioned penetration test or regression test of the CVE fix
- Database tutorials or query-debugging chats that reference mysqli_query()/PDO::query() syntax without an actual injected argument

---
Source: https://www.netzilo.com/threats/aidex-chat-prompt-injection-command-exec