CVE-2019-25687
CRITICALPegasus CMS 1.0 Remote Code Execution via extra_fields.php
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2019-25687. PoCs published by R3zk0n.
AI-analyzed exploit summary This exploit demonstrates a directory traversal and remote code execution vulnerability in Pegasus CMS via the extra_fields.php plugin. It leverages the 'safer eval' technique to execute arbitrary commands through the 'action' parameter in a POST request.
Description
Pegasus CMS 1.0 contains a remote code execution vulnerability in the extra_fields.php plugin that allows unauthenticated attackers to execute arbitrary commands by exploiting unsafe eval functionality. Attackers can send POST requests to the submit.php endpoint with malicious PHP code in the action parameter to achieve code execution and obtain an interactive shell.
Exploits (1)
This exploit demonstrates a directory traversal and remote code execution vulnerability in Pegasus CMS via the extra_fields.php plugin. It leverages the 'safer eval' technique to execute arbitrary commands through the 'action' parameter in a POST request.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H