InstantCMS <= 1.6 Remote PHP Code Execution
Published Aug 1, 2025
9.3
CRITICALCVSS 4.0
EPSS 2.85%
Description
A remote PHP code execution vulnerability exists in InstantCMS version 1.6 and earlier due to unsafe use of eval() within the search view handler. Specifically, user-supplied input passed via the look parameter is concatenated into a PHP expression and executed without proper sanitation. A remote attacker can exploit this flaw by sending a crafted HTTP GET request with a base64-encoded payload in the Cmd header, resulting in arbitrary PHP code execution within the context of the web server.
Affected products
-
Affected
- ≥ 0, ≤ 1.6
Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| InstantCMS | InstantCMS | unknown | Affected
|
- ≤ 1.6.0
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (5)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2013-7270 Advisory
- https://packetstorm.news/files/id/122176 exploitThird Party Advisory
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/instantcms_exec.rb exploitThird Party Advisory
- https://www.exploit-db.com/exploits/26622 exploit
- https://www.vulncheck.com/advisories/instantcms-remote-php-code-execution third-party-advisoryThird Party Advisory
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2013-7270 | Advisory | |
| https://packetstorm.news/files/id/122176 | exploitThird Party Advisory | |
| https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/instantcms_exec.rb | exploitThird Party Advisory | |
| https://www.exploit-db.com/exploits/26622 | exploit | |
| https://www.vulncheck.com/advisories/instantcms-remote-php-code-execution | third-party-advisoryThird Party Advisory |
Change history (0)
No recorded changes yet.
CVE.org / MITRE
CISA Vulnrichment
Red Hat
No data
GitHub
No data