PT-2025-31688 · Unknown · Instantcms

Published 2025-08-01 · Updated 2025-10-09 · CVE-2013-10051

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions InstantCMS versions prior to 1.7

Description A remote PHP code execution issue exists due to the unsafe use of the eval() function within the search view handler. User-supplied input via the look parameter is concatenated into a PHP expression and executed without proper sanitation. An attacker can exploit this flaw by sending a crafted HTTP GET request with a base64-encoded payload in the Cmd header, resulting in arbitrary PHP code execution within the context of the web server.

Recommendations Update InstantCMS to version 1.7 or later.

Exploit

Fix

Eval Injection

Weakness Enumeration

CWE-95

Related Identifiers

CVE-2013-10051

Affected Products

Instantcms

References · 8

• 🔥 https://exploit-db.com/exploits/26622 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-10051 · Security Note
• https://t.me/cveNotify/130931 · Telegram Post
• https://t.me/cveNotify/138006 · Telegram Post
• https://vulncheck.com/advisories/instantcms-remote-php-code-execution · Note
• https://t.me/CVEtracker/28975 · Telegram Post
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/instantcms_exec.rb · Note
• https://packetstorm.news/files/id/122176 · Note