Roocms
Monthly
Code injection in RooCMS (versions up to and including 1.2.2, 1.3.4 and 1.4RC2) allows an attacker who holds a privileged content-editing or administrator account to place PHP code into a page's 'content' field, which the frontend renderer passes to eval() in roocms/site_pagePHP.php, resulting in arbitrary PHP execution on the server. The flaw is CWE-94 and is remotely reachable, but exploitation is gated behind high privileges (CVSS:4.0 PR:H / CVSS:3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so realistic exposure is limited to insiders or attackers who have already obtained editor credentials rather than an anonymous internet-facing surface. Publicly available exploit code exists (a public proof-of-concept write-up is referenced), the vendor was contacted but did not respond, and no vendor-released patch has been identified at time of analysis.
Code injection in RooCMS (versions up to and including 1.2.2, 1.3.4 and 1.4RC2) allows an attacker who holds a privileged content-editing or administrator account to place PHP code into a page's 'content' field, which the frontend renderer passes to eval() in roocms/site_pagePHP.php, resulting in arbitrary PHP execution on the server. The flaw is CWE-94 and is remotely reachable, but exploitation is gated behind high privileges (CVSS:4.0 PR:H / CVSS:3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so realistic exposure is limited to insiders or attackers who have already obtained editor credentials rather than an anonymous internet-facing surface. Publicly available exploit code exists (a public proof-of-concept write-up is referenced), the vendor was contacted but did not respond, and no vendor-released patch has been identified at time of analysis.