CVE-2025-49141
BaseFortify
Publication date: 2025-06-09
Last updated on: 2025-07-30
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| psu | haxcms-nodejs | to 11.0.3 (exc) |
| psu | haxcms-php | to 11.0.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in HAX CMS PHP occurs because the `gitImportSite` functionality takes a URL string from a POST request and does not properly validate it. The input is then passed to the `proc_open` function via `set_remote`, which leads to OS command injection. An authenticated attacker can craft a malicious URL that bypasses the existing validation checks and execute arbitrary operating system commands on the backend server. The attacker can also exfiltrate the output of these commands through an HTTP request. This issue was fixed in version 11.0.3.
How can this vulnerability impact me? :
This vulnerability can have severe impacts including unauthorized execution of arbitrary OS commands on the backend server, which can lead to full system compromise. An attacker could exfiltrate sensitive data, modify or delete data, disrupt service availability, or use the server as a pivot point to attack other systems. Because the attacker must be authenticated, the risk is limited to users with some level of access, but the impact remains high.
What immediate steps should I take to mitigate this vulnerability?
Upgrade HAX CMS PHP to version 11.0.3 or later, which contains a patch for this vulnerability. Additionally, restrict access to the affected functionality to trusted authenticated users only and monitor for unusual POST requests to the gitImportSite functionality.