PHP CVE-2025-49141

CVSS 8.5 (High) reflects: AV:N (network-accessible), AC:H (high complexity—requires specific bypass techniques), PR:L (low privilege—authenticated access required), S:C (scope changes—can affect other systems), C:H/I:H/A:H (full confidentiality, integrity, and availability impact). The AC:H and PR:L ratings are critical context: this is not an unauthenticated worm vector, requiring both valid credentials and crafted input bypassing validation. However, the real-world risk is substantial because: (1) the authentication requirement is a significant gating factor, reducing attack surface compared to unauthenticated RCE; (2) the vulnerability requires knowledge of the specific bypass technique for filter_var and strpos, indicating some attacker sophistication; (3) command output exfiltration is HTTP-based, detectable but functional. Without KEV/CISA status or active exploitation data provided, this appears to be a legitimate post-authentication RCE requiring targeted attack but with severe impact potential. Organizations should prioritize patching if they expose HAX CMS authentication to untrusted users, but the authentication gate reduces it from critical to high priority relative to unauthenticated RCE vulnerabilities.

An authenticated user with access to HAX CMS's site import feature (possibly a legitimate low-privileged editor or compromised account) crafts a malicious POST request to the gitImportSite endpoint. Instead of a standard git URL like https://github.com/user/repo.git, the attacker submits a payload like https://github.com/user/repo.git;whoami; or uses shell expansion syntax ($(id)) that bypasses the filter_var URL validation (which may only check scheme/host validity) and the strpos substring checks. The set_remote function receives this input and passes it to proc_open without escaping, where the OS shell interprets the injected commands. The attacker executes whoami, cat /etc/passwd, or data exfiltration commands, receiving output via HTTP response or server error messages. Full system compromise is possible if the web server process runs with elevated privileges. The AC:H rating reflects that the attacker must understand how to craft a bypass (not trivial payloads), requiring reconnaissance or prior knowledge of the validation functions used.