CVE-2026-94103
Received Received - Intake

Code Injection in RooCMS Frontend Rendering

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: VulDB

Description
A vulnerability has been found in RooCMS up to 1.2.2/1.3.4/1.4RC2. This impacts the function eval of the file roocms/site_pagePHP.php of the component Frontend Rendering. Such manipulation of the argument content leads to code injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-94103
EUVD
EUVD-2026-83815

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
roocms roocms to 1.4.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Remote Code Execution (RCE) flaw in RooCMS versions up to 1.4.0. It occurs because the application uses the eval() function to execute PHP code stored in the database. User input is encoded before being written to the database, but the html() method fully decodes it before passing to eval(), allowing arbitrary PHP code injection. An attacker with admin privileges can inject malicious PHP code into a PHP-type page or block, leading to full server control.

Detection Guidance

Check for RooCMS installations with versions up to 1.4.0. Inspect files roocms/site_pagePHP.php (line 47) and roocms/site_blocks.php (line 54) for eval() function usage with user-controlled input. Test by injecting PHP code like echo file_get_contents('C:\\Windows\\win.ini'); in a PHP-type page via the ACP backend and verifying execution.

Impact Analysis

Exploitation can grant full server control, enabling arbitrary command execution, file manipulation, credential theft, and persistent backdoor installation. The attack leaves minimal forensic traces since malicious code resides in the database. Successful exploitation requires admin privileges but can be launched remotely.

Compliance Impact

This vulnerability allows remote code execution (RCE) via PHP code injection, which could lead to unauthorized access to sensitive data. For GDPR, this may result in data breaches requiring notification under Article 33. For HIPAA, it could expose protected health information, violating the Security Rule. The lack of response from the vendor increases compliance risks.

Mitigation Strategies

Disable eval() usage in PHP code. Implement strict PHP function whitelists in php.ini. Disable dangerous functions like system, exec, shell_exec. Restrict filesystem access with open_basedir. Add CSRF protection for ACP operations. Log all eval() executions for monitoring.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94103. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart