magicblack MacCMS10 Admin Template Editor Template.php condition privileges management

Summaryinfo

A vulnerability was found in magicblack MacCMS10 and classified as problematic. This affects an unknown function of the file application/admin/controller/Template.php of the component Admin Template Editor. Executing a manipulation of the argument condition can lead to privileges management. This vulnerability is tracked as CVE-2026-71232. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in magicblack MacCMS10 (the affected version is unknown). It has been declared as problematic. This vulnerability affects an unknown code of the file application/admin/controller/Template.php of the component Admin Template Editor. The manipulation of the argument condition with an unknown input leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log. Combined with ThinkPHP's {if} template tag, which embeds the condition attribute directly into raw PHP (<?php if(condition): ?>), an authenticated administrator could inject a payload such as {if condition="exec('id > /tmp/pwned.txt')"}{/if} to achieve remote code execution. Fixed in commit 71ad3bb29570e110d8e973acff68040a3050ddf0 (2026-06-22), which added the missing functions to the filter.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-71232 since 08/05/2026. The exploitation appears to be easy. The attack can be initiated remotely. Additional levels of successful authentication are required for exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1068.

By approaching the search of inurl:application/admin/controller/Template.php it is possible to find vulnerable targets with Google Hacking.

Applying the patch 71ad3bb29570e110d8e973acff68040a3050ddf0 is able to eliminate this problem.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• magicblack

Name

• MacCMS10

Website

• Product: https://github.com/magicblack/maccms10/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion