Executive Summary

Evolution CMS version 3.1.6 contains a remote code execution vulnerability that affects authenticated users who have module creation permissions.

This vulnerability allows these users to inject arbitrary PHP code into module parameters by sending specially crafted POST requests to /manager/index.php with malicious code in the 'post' parameter.

As a result, attackers can create modules that execute arbitrary system commands when those modules are invoked, leading to remote code execution on the server.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized execution of system commands on the server hosting Evolution CMS.

An attacker with module creation permissions can leverage this flaw to run arbitrary code, potentially leading to full system compromise, data theft, service disruption, or further attacks within the network.

Because the vulnerability requires authenticated access with specific permissions, the risk is higher if user credentials are compromised or if users are granted excessive privileges.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for suspicious POST requests to the /manager/index.php endpoint containing malicious PHP code in the 'post' parameter. Such requests indicate attempts to create modules with injected code.

You can use network monitoring or web server logs to identify these POST requests.

• Use tools like tcpdump or Wireshark to capture HTTP POST traffic to /manager/index.php.
• Search web server logs for POST requests containing suspicious PHP code patterns in the 'post' parameter, for example using grep:
• grep -i "post=.*<?php" /path/to/webserver/access.log
• Check for newly created modules or files that contain injected PHP code.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting module creation permissions to trusted users only, as the vulnerability requires authenticated users with module creation rights.

Additionally, monitor and block suspicious POST requests to /manager/index.php that contain PHP code in the 'post' parameter.

Applying updates or patches from Evolution CMS that address this vulnerability is recommended once available.

As a temporary measure, consider disabling module creation functionality if it is not essential.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not include any details about the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0