Remote Code Execution in Vvveb CMS via PHP Injection

Executive Summary

This vulnerability allows restricted site_admin users in Vvveb through 1.0.8.6 to execute remote code by injecting PHP via .sql files through the admin code editor. Attackers bypass extension and content deny-lists using an @IF macro payload that compiles into executable PHP when the model loads, enabling OS command execution as the web user.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized .sql files in the Vvveb admin directory or recent file modifications. Look for files containing @IF macro payloads or unexpected PHP code in .sql extensions. Review web server logs for suspicious admin editor saves or model loading events.

Useful 0 Not Useful 0

Impact Analysis

An attacker with restricted site_admin access could execute arbitrary code on the server, leading to data theft, system compromise, or further network infiltration. This could result in unauthorized access to sensitive data, defacement of the website, or disruption of services.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or disclosure of personal or health data, violating GDPR and HIPAA requirements for data protection and access controls. Non-compliance may result in legal penalties, fines, or reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Vvveb to the latest version beyond 1.0.8.6. Remove write permissions for restricted site_admin roles in the admin code editor. Block .sql file uploads or execution in the web root. Monitor for signs of compromise like unexpected PHP execution from .sql files.

Useful 0 Not Useful 0