CVE-2019-25687 - Vulnerability Analysis

Overview

Pegasus CMS 1.0 contains a remote code execution caused by unsafe eval functionality in extra_fields.php plugin, letting unauthenticated attackers execute arbitrary commands via POST requests to submit.php with malicious action parameter.

Severity & Score

Impact

Unauthenticated attackers can execute arbitrary code remotely, potentially gaining full control over the server.

Mitigation

Update to the latest version of Pegasus CMS.

References

• https://www.exploit-db.com/exploits/46542
• https://www.vulncheck.com/advisories/pegasus-cms-remote-code-execution-via-extra-fields-php
• https://www.wisdom.com.au/web/pegasus-cms

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner