CVE-2025-15394
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
A vulnerability was detected in iCMS up to version 8.0.0. The Save function in the file app/config/ConfigAdmincp.php of the POST Parameter Handler component allows code injection via manipulation of the config argument. The attack can be launched remotely, and the exploit is now public.
Risk Assessment
The organization may be remotely attacked, potentially leading to arbitrary code execution on the server and compromise of system integrity.
Recommendation
It is recommended to immediately update iCMS to the latest version if available, and monitor logs for suspicious requests.
Other vulnerabilities in iCMS
See all- CVE-2023-39806Critical
A SQL injection vulnerability was discovered in iCMS v7.0.16 within the bakupdata function. Attackers can exploit this flaw to execute unauthorized database queries.
- CVE-2023-39805Critical
A SQL injection vulnerability was discovered in iCMS version 7.0.16 via the 'where' parameter in admincp.php. An attacker can exploit this flaw to execute unauthorized database queries.
Original NVD description (English source)
A vulnerability was detected in iCMS up to 8.0.0. Affected is the function Save of the file app/config/ConfigAdmincp.php of the component POST Parameter Handler. The manipulation of the argument config results in code injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.