Description

A security vulnerability has been detected in Yot CMS up to 3.3.1. Affected by this issue is the function eval of the file modsys/console/admin.php of the component Admin Console. Such manipulation of the argument text leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-09-14T12:17:50.830Z",
  "pubdate": "2026-09-14T12:17:50.830Z",
  "executiveSummary": "A critical code injection vulnerability exists in Yot CMS versions up to 3.3.1 within the Admin Console component.\nThe vulnerability originates from the insecure use of the eval() function within the file modsys/console/admin.php.\nBy manipulating the 'text' argument, an unauthenticated or remotely authenticated attacker can inject and execute arbitrary PHP code on the underlying server.\nThe impact of this flaw is severe, potentially leading to full system compromise, data exfiltration, or unauthorized administrative control over the application environment.\nGiven that the exploit has been disclosed publicly, the risk of active exploitation is significant, necessitating immediate defensive action.\nThere are no specific prerequisites mentioned other than network reachability, categorizing this as a remotely exploitable vulnerability that bypasses standard application input validation.",
  "technicalDetails": "The vulnerability is classified as a Remote Code Injection flaw, specifically stemming from the improper handling of user-supplied input in the Admin Console component of Yot CMS.\nThe root cause is located in modsys/console/admin.php, where the application passes the 'text' argument directly into an eval() function. The eval() language construct is inherently dangerous as it executes the provided string as PHP code within the current process context.\nThe attack flow initiates when an adversary submits a crafted HTTP request containing a malicious payload via the 'text' parameter. Because the application fails to sanitize or validate this input, the attacker can inject arbitrary PHP instructions, such as system commands (e.g., shell_exec, passthru) or file manipulation functions.\nOnce the payload is received by modsys/console/admin.php, the server-side script executes the injected code with the privileges of the web server user (e.g., www-data).\nExploitation allows an attacker to achieve Remote Code Execution (RCE) without requiring specialized knowledge of the CMS backend architecture. Since the exploit is publicly available, threat actors can automate the delivery of payloads to target installations of Yot CMS 3.3.1 and earlier.\nThe post-exploitation impact includes the ability to read sensitive configuration files, modify database content, pivot into the internal network, or install persistent backdoors. Because the eval() execution occurs at the application level, the resulting shell provides the attacker with the same read/write/execute permissions as the web server process, potentially allowing for privilege escalation if the server environment is misconfigured.\nThis vulnerability is particularly critical because it bypasses conventional input filters that might otherwise restrict specific characters, as the intent of the eval() function is to interpret the provided input as executable logic rather than literal string data."
}