Description

A security flaw has been discovered in DefaultFuction Notice-System-Managent 2.0. This issue affects the function GroovyShell.evaluate of the file /execute of the component NoticeController. The manipulation results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project confirms, that "it’s being processed".

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-16T05:16:48.443Z",
  "pubdate": "2026-08-16T05:16:48.443Z",
  "executiveSummary": "A critical security flaw has been identified in DefaultFuction Notice-System-Managent 2.0, specifically residing within the NoticeController component. The vulnerability manifests as a code injection flaw due to insecure execution handling via the GroovyShell.evaluate function exposed through the /execute endpoint. This remotely exploitable vulnerability allows unauthenticated or remote adversaries to inject and execute arbitrary code within the context of the underlying application server, leading to complete system compromise. The risk implications are severe, as arbitrary code execution can result in full data exfiltration, system takeover, or further lateral movement within the network infrastructure. Public exploits for this vulnerability have been released, significantly increasing the probability of active exploitation in the wild. The vendor has acknowledged the issue and confirmed that it is currently being processed for remediation.",
  "technicalDetails": "The vulnerability is rooted in the NoticeController component of DefaultFuction Notice-System-Managent 2.0, specifically within the handling logic associated with the /execute endpoint. The underlying root cause stems from the direct and unsanitized passing of user-supplied input into the GroovyShell.evaluate function. GroovyShell is designed to parse and execute Groovy scripts dynamically at runtime. When an application fails to properly validate, sanitize, or restrict the input supplied to this evaluation mechanism, it introduces a severe code injection vector.\nThe attack flow begins when a remote attacker crafts a malicious HTTP request directed toward the vulnerable /execute endpoint of the NoticeController. The request contains a specially crafted payload leveraging Groovy syntax designed to execute arbitrary system commands or application-level logic. Upon receiving the request, the application passes the untrusted input directly to the GroovyShell.evaluate function without prior validation or sandboxing. The Groovy environment interprets and executes the malicious payload with the full privileges of the hosting application process.\nNetwork exposure for this vulnerability is remote, meaning attackers do not require prior local access to the target system to initiate the attack vector. Based on the provided description, the flaw allows for remote exploitation without documented authentication or privilege requirements, enabling external threat actors to interact directly with the vulnerable /execute endpoint. The payload behavior depends entirely on the attacker's intent, ranging from executing operating system shell commands to manipulating internal application states or establishing persistent backdoors.\nThe post-exploitation impact includes complete loss of confidentiality, integrity, and availability of the affected system. Successful code execution grants the adversary the ability to read sensitive files, modify system configurations, pivot to internal network segments, or deploy ransomware and other malicious payloads. Because public exploit code is already available, systems running DefaultFuction Notice-System-Managent 2.0 remain at high risk until appropriate defensive measures or vendor patches are applied."
}