Executive brief
Pegasus CMS, a web content management system, contains a critical security flaw in its 'extra_fields' plugin. This vulnerability allows an unauthorized person to remotely take control of the website by sending a specially crafted request. An attacker could use this to steal sensitive data, modify website content, or disrupt business operations.
Technical details
A remote code execution (RCE) vulnerability exists in Pegasus CMS 1.0 within the extra_fields.php plugin. The flaw stems from the use of an unsafe eval() function that processes user-supplied input without adequate sanitization. An unauthenticated attacker can exploit this by sending a POST request to the submit.php endpoint, including malicious PHP code in the 'action' parameter. Successful exploitation allows the attacker to execute arbitrary system commands and potentially obtain an interactive shell on the underlying server. Public exploit code is available.
Affected products
- Wisdom Pegasus CMS 1.0
Timeline
- 2019-03-14: disclosed: Initial exploit published on Exploit-DB
- 2026-04-05: advisory: NVD publication date