Description

A vulnerability has been found in RooCMS up to 1.2.2/1.3.4/1.4RC2. This impacts the function eval of the file roocms/site_pagePHP.php of the component Frontend Rendering. Such manipulation of the argument content leads to code injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-09-21T02:16:53.673Z",
  "pubdate": "2026-09-21T02:16:53.673Z",
  "executiveSummary": "A critical code injection vulnerability exists in RooCMS versions up to 1.2.2, 1.3.4, and 1.4RC2. The flaw resides within the Frontend Rendering component, specifically involving the improper handling of user-supplied input in the roocms/site_pagePHP.php file.\nThe vulnerability allows an unauthenticated remote attacker to execute arbitrary PHP code on the target server. By manipulating the 'content' argument passed to the eval() function, an attacker can bypass security controls to achieve Remote Code Execution (RCE).\nGiven that the vendor has failed to respond to disclosures, this vulnerability remains unpatched, posing a significant risk to the confidentiality, integrity, and availability of affected systems. Successful exploitation grants the attacker the capability to compromise the underlying operating system, access sensitive data, or establish persistence within the hosting environment. Public availability of exploit code further elevates the risk of widespread automated exploitation.",
  "technicalDetails": "The vulnerability is a classic case of unsafe input validation leading to arbitrary code execution via the PHP eval() function. The root cause is the direct passage of unsanitized or insufficiently sanitized data—provided via the 'content' argument—into a dangerous sink located in the roocms/site_pagePHP.php file within the Frontend Rendering component.\nThe attack flow begins when an attacker identifies the entry point in the roocms/site_pagePHP.php script. Because the application fails to perform input validation or enforce strict context-aware output encoding, it permits the injection of arbitrary PHP syntax into the application's runtime environment. When the script processes a request, the user-controlled 'content' parameter is passed to the eval() function without adequate restriction, resulting in the interpretation and execution of the injected code as part of the server-side process.\nExploitation is possible remotely without the requirement for prior authentication or elevated privileges. Because the web server executes the injected payload with the permissions of the web server service account, the post-exploitation impact is severe. An attacker can leverage this execution to read sensitive configuration files, modify system files, connect to backend databases, or perform lateral movement within the network.\nAffected versions include RooCMS up to 1.2.2, 1.3.4, and 1.4RC2. The attack surface is exposed over the network, typically via HTTP/HTTPS requests. Since the function relies on the direct evaluation of strings, any characters that allow for command or code breakout are processed by the PHP interpreter. The lack of proper remediation by the vendor implies that current deployments remain inherently vulnerable to malicious payloads designed to manipulate the application's execution state.\nFurthermore, the use of eval() in production code is a dangerous anti-pattern that violates fundamental secure coding principles. By allowing user input to influence the code flow, the application fails to provide necessary encapsulation, allowing attackers to manipulate the application logic at runtime. Subsequent to execution, an attacker may deploy a web shell to maintain persistent access to the server, facilitating long-term data exfiltration or internal reconnaissance."
}