ImpressCMS Remote Code Execution Vulnerability in Autotasks Administrative Interface

A remote code execution vulnerability has been identified in ImpressCMS version 1.4.2, specifically within the autotasks administrative interface. This vulnerability allows authenticated attackers to execute arbitrary PHP code by injecting malicious code into the sat_code parameter. Exploitation involves authenticating and sending a POST request to /modules/system/admin.php?fct=autotasks&op=mod with a crafted sat_code that includes PHP commands. This action creates an executable file that can accept arbitrary commands via GET parameters.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where ImpressCMS is hosted.

Reproduction

To reproduce this vulnerability, an authenticated user must send a POST request to the autotasks administrative interface with a crafted sat_code parameter that includes PHP code. Once the request is processed, the injected code is executed on the server.