Executive brief
iCMS is a content management system used to build and manage websites. A vulnerability in the admin panel's configuration handler allows authenticated administrators to execute arbitrary PHP functions and commands on the server. An attacker with admin credentials could completely compromise the web server, steal sensitive data, or use it as a foothold to attack internal networks.
Technical details
The vulnerability is a code injection flaw in app/config/ConfigAdmincp.php (lines 110–123) where the save() function accepts user-supplied POST parameters (config and saveCall) without validation. The saveCall parameter is passed directly to call_user_func_array(), allowing an attacker to execute any PHP callable function. The config parameter provides the function arguments. Attack requires valid admin credentials and a CSRF token but no authentication bypass is needed—it is a post-authentication vulnerability. An attacker with admin access can invoke dangerous functions like system(), file_put_contents(), or eval() to achieve remote code execution, file manipulation, or server takeover. No patch status has been reported by the vendor.
Affected products
- iCMS iCMS up to 8.0.0
Timeline
- 2025-12-31: disclosed
- other: Exploit is public and may be used in the wild