CyberRota Analysis
AI-GeneratedCraft CMS versions prior to 5.10.12 are vulnerable to a remote code execution flaw that allows authenticated content editors to instantiate arbitrary classes via the criteria parameter in the element-index endpoint. This vulnerability can be exploited by attackers to execute malicious PHP code, potentially compromising the integrity of the application. Organizations using affected versions should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteria[withTransforms][0][class] that reaches ImageTransforms::normalizeTransform(), then use a PHP gadget chain with yii\rbac\PhpManager to execute code by pointing itemFile to a request log containing PHP payload in the User-Agent header.