CVE-2025-15148
Remote Code Injection in CmsEasy Backend Template Management
Publication date: 2025-12-28
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cmseasy | cmseasy | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows authenticated administrators to execute arbitrary code remotely, potentially leading to full system compromise including unauthorized access, modification, or deletion of sensitive data. Such a compromise can result in violations of data protection standards and regulations like GDPR and HIPAA, which require safeguarding confidentiality, integrity, and availability of personal and sensitive information. Therefore, exploitation of this vulnerability could lead to non-compliance with these regulations due to potential data breaches and unauthorized data processing. [1, 3]
Can you explain this vulnerability to me?
This vulnerability is a flaw in CmsEasy up to version 7.7.7, specifically in the function savetemp_action within the /lib/admin/template_admin.php file of the Backend Template Management Page component. It allows an attacker to manipulate the argument content/tempdata, which can lead to code injection. The attack can be performed remotely, and an exploit has been published.
How can this vulnerability impact me? :
The vulnerability can allow an attacker to inject and execute arbitrary code remotely on the affected system. This can lead to unauthorized access, data manipulation, or disruption of service, potentially compromising the confidentiality, integrity, and availability of the system.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking for the presence of the vulnerable CmsEasy version (up to 7.7.7) and by searching for the vulnerable file `/lib/admin/template_admin.php`. Attackers may use Google dorking with queries like `inurl:lib/admin/template_admin.php` to identify vulnerable targets. On your system, you can verify if the vulnerable function `savetemp_action` exists in the specified file. Additionally, monitoring for unusual template edits or the presence of suspicious PHP code injected into template files under `/data/template/` can indicate exploitation. Since exploitation requires authenticated administrator access, reviewing admin activity logs for unexpected template modifications is recommended. Specific commands to detect signs of compromise include searching for webshell files (e.g., `shell.php`) in the web root or template directories, for example: `find /path/to/webroot -name 'shell.php'` or grepping for PHP eval usage in template files: `grep -r '<?php eval' /path/to/data/template/`. Network detection can include monitoring HTTP requests with the `pageset=1` parameter or unusual POST requests to template management endpoints. [1, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include: 1) Restrict access to the CmsEasy backend to trusted administrators only, ensuring strong authentication and limiting network exposure. 2) Avoid using CmsEasy versions up to 7.7.7; upgrade to a non-vulnerable version or replace the product if no patch is available. 3) Sanitize and filter PHP code tags (`<?php`, `<?`, `?>`) in template content before saving to prevent code injection. 4) Restrict or disable the use of the `pageset` parameter to authenticated administrators only to prevent unauthorized template loading from `/data/template/`. 5) Monitor and audit template files for unauthorized changes or injected code. 6) Implement a sandbox environment for template execution and consider applying Content Security Policy (CSP) to limit template functionality. Since no official patch or countermeasure is published, replacing the affected product or disabling the vulnerable functionality is advised. [3, 1]