EUVD-2025-209386
GHSA-qcqx-gfxj-4j65
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionNVD
An issue was discovered in Kiamo before 8.4 allowing authenticated administrative attackers to execute arbitrary PHP code on the server.
AnalysisAI
Arbitrary PHP code execution in Kiamo customer engagement platform (pre-8.4) allows authenticated administrative users to run commands on the underlying server. The vulnerability exploits a code injection weakness (CWE-94) via network-accessible interfaces with low complexity. No public exploit identified at time of analysis, with EPSS indicating 2% (5th percentile) exploitation probability. Detailed technical write-up published by security researcher at Hackvens confirms exploitability through administrative access.
Technical ContextAI
Kiamo is a customer engagement and contact center platform. This vulnerability involves CWE-94 (Improper Control of Generation of Code / Code Injection), where authenticated administrators can inject and execute arbitrary PHP code on the server. The flaw likely resides in administrative interfaces that fail to properly sanitize or validate user-supplied input before passing it to PHP execution contexts such as eval(), include(), or dynamic function calls. The CVSS vector (AV:N/AC:L) indicates the vulnerable functionality is network-accessible with straightforward exploitation requiring no specialized attack conditions. Versions prior to 8.4 are confirmed vulnerable, suggesting the issue was addressed in the 8.4 release. The vulnerability requires low-privilege authenticated access (PR:L), though in the context of 'administrative attackers' this likely means any user with administrative role can exploit it.
RemediationAI
Upgrade Kiamo to version 8.4 or later, which addresses this code injection vulnerability. The version 8.4 release appears to be the first patched version based on the 'before 8.4' qualifier in the vulnerability description. Consult the vendor advisory at http://kiamo.com for specific upgrade instructions and compatibility considerations. Review administrative access logs for unusual activity prior to patching. As an interim mitigation, restrict administrative interface access to trusted IP ranges via firewall rules, enforce multi-factor authentication for all administrative accounts, and audit the list of users with administrative privileges to ensure least-privilege principles. Monitor for unexpected PHP process execution or file system modifications originating from the Kiamo application context.
Share
External POC / Exploit Code
Leaving vuln.today