Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-49141

HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.3, the `gitImportSite` functionality obtains a URL string from a POST request and insufficiently validates user input. The `set_remote` function later passes this input into `proc_open`, yielding OS command injection. An authenticated attacker can craft a URL string that bypasses the validation checks employed by the `filter_var` and `strpos` functions in order to execute arbitrary OS commands on the backend server. The attacker can exfiltrate command output via an HTTP request. Version 11.0.3 contains a patch for the issue.

Published

2025-06-09T21:15:47.360

Last Modified

2025-07-30T17:36:08.923

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 8.5 (HIGH)

Weaknesses

Type: Secondary
CWE-78

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	psu	haxcms-nodejs	< 11.0.3	Yes
Application	psu	haxcms-php	< 11.0.0	Yes

References

https://github.com/haxtheweb/haxcms-nodejs/commit/5131fea6b6be611db76a618f89bd2e164752e9b3 Patch ([email protected])
https://github.com/haxtheweb/issues/security/advisories/GHSA-g4cf-pp4x-hqgw Exploit, Issue Tracking, Third Party Advisory ([email protected])
https://github.com/haxtheweb/issues/security/advisories/GHSA-g4cf-pp4x-hqgw Exploit, Issue Tracking, Third Party Advisory (134c704f-9b21-4f2e-91b3-4a467353bcc0)