| Title | ctcms 2.1.2 Command Injection |
|---|
| Description | CTCMS (Ctcms video system) version 2.1.2 contains a Server-Side Template Injection (SSTI) vulnerability in the backend template management functionality. An authenticated administrator can edit templates and inject malicious template syntax, leading to remote code execution.The vulnerability exists in the template management module. When an administrator edits template files (such as head.html), the system processes template syntax without proper sanitization. By injecting malicious template code containing PHP functions like eval(), an attacker can achieve remote code execution when the template is rendered. |
|---|
| Source | ⚠️ https://note-hxlab.wetolink.com/share/Ros8ZIeCLQrN |
|---|
| User | airrudder (UID 25092) |
|---|
| Submission | 12/05/2025 09:00 (6 months ago) |
|---|
| Moderation | 12/15/2025 18:02 (10 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 336488 [CTCMS Content Management System up to 2.1.2 Frontend/Template Management CT_Parser.php special elements used in a template engine] |
|---|
| Points | 20 |
|---|