| शीर्षक | Yot Content Management System 3.3.1 console admin eval of POST text leads to remote code execution |
|---|
| विवरण | YOT III ships a system module named console whose admin page treats the POST parameter text as PHP source and executes it with eval(). After an administrator session is obtained (including via other unauthenticated privilege paths present in the same codebase), an attacker can POST arbitrary PHP and achieve remote code execution on the web server. The feature has no sandbox, command allowlist, CSRF protection, or secondary confirmation and is effectively an intentional webshell exposed through the CMS routing layer. |
|---|
| स्रोत | ⚠️ https://github.com/dddwmr/CVE/blob/main/YOT%20III%20modsys%3Aconsole%20admin%20eval%20of%20POST%20text%20leads%20to%20remote%20code%20execution.md |
|---|
| उपयोगकर्ता | dwmm (UID 29483) |
|---|
| सबमिशन | 07/08/2026 07:36 AM (1 महीना पहले) |
|---|
| संयम | 13/09/2026 10:22 AM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 403251 [Yot CMS तक 3.3.1 Admin Console modsys/console/admin.php eval text अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|