{"uuid": "517a8818-24cb-43dd-9b4f-f82ca27ec317", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-49141", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/17782", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-49141\n\ud83d\udd25 CVSS Score: 8.6 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)\n\ud83d\udd39 Description: HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.3, the `gitImportSite` functionality obtains a URL string from a POST request and insufficiently validates user input. The `set_remote` function later passes this input into `proc_open`, yielding OS command injection. An authenticated attacker can craft a URL string that bypasses the validation checks employed by the `filter_var` and `strpos` functions in order to execute arbitrary OS commands on the backend server. The attacker can exfiltrate command output via an HTTP request. Version 11.0.3 contains a patch for the issue.\n\ud83d\udccf Published: 2025-06-09T21:11:08.889Z\n\ud83d\udccf Modified: 2025-06-09T21:11:08.889Z\n\ud83d\udd17 References:\n1. https://github.com/haxtheweb/issues/security/advisories/GHSA-g4cf-pp4x-hqgw\n2. https://github.com/haxtheweb/haxcms-nodejs/commit/5131fea6b6be611db76a618f89bd2e164752e9b3", "creation_timestamp": "2025-06-09T21:31:56.000000Z"}