Executive brief
Kiamo, a customer interaction management platform, contains a vulnerability that allows users with administrative privileges to execute arbitrary PHP code on the server. While the vendor originally intended this as a management feature, it can be abused by a compromised or malicious administrator to gain full control over the underlying server, potentially leading to data theft or service disruption. Organizations should update to version 8.4, which introduces restrictions on the functions that can be executed.
Technical details
A code injection vulnerability exists in Kiamo's 'Script' tool within the 'Tools' section of the administrative interface. The application fails to sufficiently restrict the PHP functions available through the PHPEditor.init() callback, allowing an authenticated user with administrative privileges to execute arbitrary PHP commands. This can be leveraged to establish a reverse shell and gain OS-level access to the server. While the vendor disputes the classification as a vulnerability, citing it as an intended legacy feature, they have introduced function-level restrictions in version 8.4 to mitigate the risk of arbitrary code execution.
Affected products
- Kiamo Kiamo before 8.4
Timeline
- 2025-12-08: disclosed: Vulnerability discovered and vendor notified
- 2025-12-18: patched: Fix released in Kiamo version 8.4
- 2026-04-09: advisory: CVE published to NVD