A command injection vulnerability exists in Industrial Application Software IAS Canias ERP version 8.03 in the RMI Interface component's Runtime.getRuntime.exec function. Manipulating the argument troiaCode can lead to remote OS command injection. The vulnerability has a CVSS score of 6.3 (medium severity). Public exploit code is available, but no vendor response or patch has been provided.