CVE-2021-47939
Authenticated RCE in Evolution CMS via Malicious Module Parameters
Publication date: 2026-05-10
Last updated on: 2026-05-10
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
Evolution CMS version 3.1.6 contains a remote code execution vulnerability that affects authenticated users who have module creation permissions.
This vulnerability allows these users to inject arbitrary PHP code into module parameters by sending specially crafted POST requests to /manager/index.php with malicious code in the 'post' parameter.
As a result, attackers can create modules that execute arbitrary system commands when those modules are invoked, leading to remote code execution on the server.
How can this vulnerability impact me? :
This vulnerability can have severe impacts including unauthorized execution of system commands on the server hosting Evolution CMS.
An attacker with module creation permissions can leverage this flaw to run arbitrary code, potentially leading to full system compromise, data theft, service disruption, or further attacks within the network.
Because the vulnerability requires authenticated access with specific permissions, the risk is higher if user credentials are compromised or if users are granted excessive privileges.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for suspicious POST requests to the /manager/index.php endpoint containing malicious PHP code in the 'post' parameter. Such requests indicate attempts to create modules with injected code.
You can use network monitoring or web server logs to identify these POST requests.
- Use tools like tcpdump or Wireshark to capture HTTP POST traffic to /manager/index.php.
- Search web server logs for POST requests containing suspicious PHP code patterns in the 'post' parameter, for example using grep:
- grep -i "post=.*<?php" /path/to/webserver/access.log
- Check for newly created modules or files that contain injected PHP code.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting module creation permissions to trusted users only, as the vulnerability requires authenticated users with module creation rights.
Additionally, monitor and block suspicious POST requests to /manager/index.php that contain PHP code in the 'post' parameter.
Applying updates or patches from Evolution CMS that address this vulnerability is recommended once available.
As a temporary measure, consider disabling module creation functionality if it is not essential.