CVE-2020-25538

HIGH

CMSuno 1.6.2 - Authenticated Remote Code Execution via Lang Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2020-25538.

AI-analyzed exploit summary This Ruby script exploits an authenticated remote code execution vulnerability in CMSUno 1.6.1 and 1.6.2 by injecting malicious payloads into the 'user' or 'lang' parameters during password update requests. It handles authentication, anti-CSRF tokens, and command execution via system calls.

Description

An authenticated attacker can inject malicious code into "lang" parameter in /uno/central.php file in CMSuno 1.6.2 and run this PHP code in the web page. In this way, attacker can takeover the control of the server.

Exploits (1)

exploitdb WORKING POC
rubywebappsphp
https://www.exploit-db.com/exploits/49485

This Ruby script exploits an authenticated remote code execution vulnerability in CMSUno 1.6.1 and 1.6.2 by injecting malicious payloads into the 'user' or 'lang' parameters during password update requests. It handles authentication, anti-CSRF tokens, and command execution via system calls.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: CMSUno 1.6.1, 1.6.2
Auth required
Prerequisites: Valid credentials for CMSUno · Access to the login and central.php endpoints
devstral-2 · analyzed Feb 19, 2026 Full analysis →

References (2)

Core 2
Core References
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/161162/CMSUno-1.6.2-Remote-Code-Execution.html

Scores

CVSS v3 8.8
EPSS 0.0476
EPSS Percentile 89.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-94
Status published
Products (1)
cmsuno_project/cmsuno 1.6.2
Published Nov 13, 2020
Tracked Since Feb 18, 2026