MuYuCMS Code Injection Vulnerability in Template Management Component

A code injection vulnerability has been identified in MuYuCMS versions through 2.7, specifically within the Template Management component's admin.php file. This vulnerability allows remote attackers to inject malicious code, which can then be executed on the server.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where MuYuCMS is installed.

Reproduction

To reproduce this vulnerability, log into the MuYuCMS admin panel and navigate to the Template Management section. Click on the template list, then select the option for online editing. Once in the editor, create a new PHP file and write a simple PHP script, such as one that displays PHP information. After saving the file, it can be accessed and executed, demonstrating the code injection vulnerability.