RiteCMS CVE-2025-67172

Exploitation requires an authenticated session with administrative/high privileges in RiteCMS v3.1.0 (CVSS PR:H), from which the attacker supplies crafted input that reaches the parse_special_tags() function in cms/includes/functions.inc.php, where it is passed into an OS command (CWE-78). Limiting factors: the PR:H prerequisite means an unprivileged or unauthenticated outsider cannot exploit this directly - valid admin access must first be obtained; no user interaction is needed once that access exists (UI:N). The practical attack surface is further constrained by the product's rarity, as only installations of RiteCMS 3.1.0 are affected.

This is a genuine but bounded risk. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, C:H/I:H/A:H) scores 7.2 (High) and describes network-reachable, low-complexity exploitation that nonetheless requires high privileges (PR:H) - meaning the attacker must already hold an authenticated administrative session in RiteCMS before invoking the vulnerable parse_special_tags() OS command injection (CWE-78). A public proof-of-concept exists (mbiesiad vulnerability-research repo), which lowers the skill barrier, but there is NO CISA KEV listing and NO EPSS score was provided, so there is no evidence of active or widespread exploitation. The signals are therefore consistent rather than conflicting: a high technical impact gated behind an administrative-authentication prerequisite, with available-but-unweaponized exploit code. The dominant mitigating factor is prevalence - RiteCMS is an obscure, small-footprint open-source CMS, so real-world attack surface is minimal. Net: treat as a priority only for the specific populations actually running RiteCMS v3.1.0, where it should be patched promptly because an authenticated admin can escalate to full server command execution; for everyone else it is low real-world risk despite the High CVSS. Note: no EPSS value was supplied in the input, so widespread-exploitation probability could not be quantified.

An attacker who has obtained or been granted RiteCMS administrator credentials (e.g., a malicious insider, a compromised admin account, or via credential reuse) logs into the backend and submits content containing crafted special tags that reach the parse_special_tags() function. Because input is passed into an OS command, the attacker injects shell commands that execute on the underlying web server with the privileges of the web process. A public proof-of-concept is available, making reliable reproduction straightforward for anyone with admin access.