Fearlesscms
Monthly
FearlessCMS 0.1.2b and earlier lets an authenticated administrator supply an arbitrary Git repository URL to the dashboard updater (admin/updater-handler.php → perform_update → update.sh), which clones the repository and overwrites the live plugins/, admin/, and includes/ directories without validating the repository's identity, signatures, or contents. Because router.php allows existing PHP files under plugins/ to be executed by the PHP built-in development server - the project's documented run mode - the injected update content runs as arbitrary PHP under the web server account and can persist as a backdoor, yielding full compromise of confidentiality, integrity, and availability. Exploitation is gated on high-privilege (administrator) authentication and affects only versions at or below 0.1.2b; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was provided.
FearlessCMS 0.1.2b and earlier lets an authenticated administrator supply an arbitrary Git repository URL to the dashboard updater (admin/updater-handler.php → perform_update → update.sh), which clones the repository and overwrites the live plugins/, admin/, and includes/ directories without validating the repository's identity, signatures, or contents. Because router.php allows existing PHP files under plugins/ to be executed by the PHP built-in development server - the project's documented run mode - the injected update content runs as arbitrary PHP under the web server account and can persist as a backdoor, yielding full compromise of confidentiality, integrity, and availability. Exploitation is gated on high-privilege (administrator) authentication and affects only versions at or below 0.1.2b; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was provided.