EUVD-2025-19468Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network accessible, low privileges required, low impact from backdoor
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability, which was classified as critical, has been found in Conjure Position Department Service Quality Evaluation System up to 1.0.11. Affected by this issue is the function eval of the file public/assets/less/bootstrap-less/mixins/head.php. The manipulation of the argument payload leads to backdoor. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
Backdoor in Conjure Position Department Service Quality Evaluation System allows remote authenticated users with low privileges to execute arbitrary code via a crafted payload to the eval function in a PHP mixin file. A public proof-of-concept exploit exists, but EPSS probability is low (0.08%) and no active exploitation has been confirmed. The CVSS score (2.1) and vector indicate low impact, contradicting the 'critical' classification in the description.
Technical ContextAI
The vulnerability resides in the PHP file public/assets/less/bootstrap-less/mixins/head.php, which is part of a Bootstrap LESS mixin library included with the application. The function eval is called with a user-controlled argument (payload), allowing arbitrary PHP code execution. This is a classic backdoor (CWE-912) that bypasses normal application logic. The application is built on PHP and likely uses the Bootstrap framework for front-end styling. CPE data from EUVD confirms specific version numbers ranging from 1.0.0 to 1.0.11.
RemediationAI
No vendor-released patch identified at time of analysis. As a workaround, restrict access to the file public/assets/less/bootstrap-less/mixins/head.php by blocking HTTP requests to that path (e.g., via web server configuration) or by removing/renaming the file if not needed. Additionally, disable the PHP eval() function if possible (e.g., using disable_functions in php.ini). Monitor server logs for exploitation attempts targeting that file. The trade-off of blocking the file may affect legitimate LESS compilation if the application uses it dynamically.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-912 – Hidden Functionality
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today