PopojiCMS Remote Command Execution Vulnerability

A remote command execution vulnerability has been identified in PopojiCMS version 2.0.1. This issue allows authenticated administrative users to inject malicious PHP code through the metadata settings endpoint. Once the code is injected, it can be used to create a web shell that executes arbitrary system commands via a GET parameter.

Impact

Exploitation of this vulnerability allows for authenticated remote command execution on the server where PopojiCMS is hosted.

Reproduction

To reproduce this vulnerability, an administrative user must log into the PopojiCMS admin panel. After logging in, the user can navigate to the metadata settings endpoint and inject PHP code into the meta content. Once the code is injected, it can be executed by accessing the web shell through the specified GET parameter.