iCMS CVE-2025-15394

No vendor-released patch identified at time of analysis. The vendor did not respond to early disclosure attempts. Immediate remediation requires upgrading to a version newer than 8.0.0 if available from alternative sources, or switching to an actively maintained CMS alternative. As an interim compensating control, restrict administrative access to the ConfigAdmincp.php component to only trusted internal networks or IP ranges using web server access controls (e.g., .htaccess or web application firewall rules), and audit all administrative user accounts for unauthorized activity. Disable direct POST access to the config parameter if the application permits configuration via alternative methods (API, database, file-based config). Monitor application logs for suspicious config parameter submissions containing code patterns (parentheses, function names, shell operators). These controls reduce exploitation likelihood but do not eliminate the underlying code injection flaw.