Executive brief
ImpressCMS, a content management system used for building websites, contains a security flaw in its administrative task scheduler. An attacker with valid login credentials can inject malicious code into the system's automated tasks. This allows them to take full control of the web server, potentially leading to the theft of sensitive data, website defacement, or a complete service shutdown.
Technical details
A remote code execution (RCE) vulnerability exists in ImpressCMS 1.4.2 due to improper input validation in the 'autotasks' administrative component. An authenticated attacker can send a specially crafted POST request to /modules/system/admin.php?fct=autotasks&op=mod, injecting PHP code into the 'sat_code' parameter. This injection results in the creation of a new PHP file on the server that can be accessed remotely to execute arbitrary system commands via GET parameters. The vulnerability is classified as CWE-94 (Code Injection) and requires low-level authentication to exploit. Public exploit code is available.
Affected products
- ImpressCMS ImpressCMS 1.4.2
Timeline
- 2021-09-15: disclosed: Original exploit published on Exploit-DB
- 2026-05-10: advisory: NVD/VulnCheck advisory published