High · published December 11, 2025
🚨 Just one clever tweak in PopojiCMS and an admin can unleash an entire web shell on their server! 🔥 Think of it like a delivery service that lets you adjust the address for packages without verification—imagine ordering a pizza and casually rerouting it to someone else's house without anyone checking! This vulnerability could allow attackers to execute any system command they desire, potentially leading to a complete takeover of the server. With an unauthorized web shell in place, the entire administrative control is up for grabs, putting sensitive data and processes at serious risk!
Think of it like a delivery service that lets you adjust the address for packages without verification—imagine ordering a pizza and casually rerouting it to someone else's house without anyone checking! In PopojiCMS 2.0.1, an authenticated remote command execution vulnerability exists in the metadata settings endpoint. This flaw permits attackers to inject malicious PHP code via a GET parameter after logging in, allowing system commands to be executed.
This vulnerability could allow attackers to execute any system command they desire, potentially leading to a complete takeover of the server. With an unauthorized web shell in place, the entire administrative control is up for grabs, putting sensitive data and processes at serious risk! Immediately update to the latest version of PopojiCMS to mitigate this vulnerability. Additionally, review the permissions and security settings for administrative users to prevent unauthorized code execution. Implement monitoring to detect any unauthorized changes in the metadata settings. You've got this! Follow these steps, and you'll be locking down your PopojiCMS in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| popojicms/popojicms | all versions | — |