GravCMS Arbitrary YAML Write and PHP Code Execution Vulnerability

An unauthenticated vulnerability in GravCMS version 1.10.7 allows remote attackers to write arbitrary YAML configuration and execute PHP code via the scheduler endpoint. Exploitation involves injecting base64-encoded payloads through the admin-nonce parameter to create malicious custom jobs that execute system commands.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of PHP code on the server, potentially allowing for further attacks or system compromise.

Reproduction

To reproduce this vulnerability, send a POST request to the '/admin/config/scheduler' endpoint with the 'admin-nonce' parameter. Include a base64-encoded PHP payload in the 'data[custom_jobs][ncefs][command]' field. The injected payload will be executed on the server, allowing for arbitrary command execution.