Description

A vulnerability was found in mtrano APENCMS up to 6546096d354153309693efabb9a0d824628ed4f5. The affected element is the function eval of the file cms/weasel.php of the component Template Engine. The manipulation of the argument $_CMS['site'] results in code injection. The attack may be performed from remote. The exploit has been made public and could be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-22T15:17:25.450Z",
  "pubdate": "2026-09-22T15:17:25.450Z",
  "executiveSummary": "A critical code injection vulnerability exists within the APENCMS template engine, specifically affecting the cms/weasel.php file. The vulnerability stems from the improper handling of user-supplied input provided via the $_CMS['site'] argument, which is subsequently passed to an eval() function without sufficient sanitization or validation.\nThis flaw allows a remote, unauthenticated attacker to execute arbitrary PHP code on the underlying server. Successful exploitation grants the attacker full control over the application's context, potentially leading to unauthorized data access, modification, or complete system compromise. Given that the exploit vector is publicly available and the vendor has remained unresponsive, the risk to deployments utilizing this version is severe.\nThe vulnerability is inherent to the product's continuous delivery model, where affected versions are defined by specific commit hashes rather than traditional version numbers. Because the vulnerability is remotely exploitable, organizations should treat this as a high-priority security risk requiring immediate defensive intervention.",
  "technicalDetails": "The vulnerability is rooted in the insecure implementation of the PHP eval() function within the cms/weasel.php component of the APENCMS template engine. Specifically, the application logic directly incorporates the value of the $_CMS['site'] parameter into a string that is then executed as PHP code by the engine.\nThe attack flow begins with a remote request initiated by an attacker who targets the vulnerable cms/weasel.php endpoint. By manipulating the $_CMS['site'] parameter, an attacker can inject malicious PHP syntax. Because the input is not subjected to allow-listing, context-aware escaping, or input validation, the application treats the attacker's payload as legitimate source code.\nWhen the script processes the request, the eval() function interprets the manipulated input, leading to code injection. The payload executes with the privileges of the web server process (e.g., www-data). This allows the attacker to bypass access controls, pivot into the underlying server environment, read sensitive configuration files (such as database credentials), or execute shell commands to establish persistent backdoors.\nThe affected component is the Template Engine, which erroneously trusts the site configuration variable. As APENCMS utilizes a rolling release architecture, all deployments up to the commit hash 6546096d354153309693efabb9a0d824628ed4f5 are confirmed to be susceptible. There are no authentication or authorization requirements to trigger this vulnerability, as the injection point resides within a public-facing script. The exploit vector is fully remote, requiring only network connectivity to the web server hosting the CMS.\nPost-exploitation, the attacker maintains full control over the server-side environment. They can exfiltrate sensitive application data, modify the integrity of the database, or distribute malware to users visiting the compromised site. The absence of a vendor patch necessitates manual remediation, as the application remains inherently insecure in its current state."
}