FoxCMS Remote Code Execution Vulnerability

A remote code execution vulnerability exists in FoxCMS version 1.2.5. The issue arises in the index.html component, where an attacker can execute arbitrary code via the case display page.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server.

Reproduction

To reproduce this vulnerability, send a request to the case display page of the index.html component, including a crafted 'id' parameter that contains a PHP command, such as 'print(phpinfo())'. The response will include the output of the executed command, indicating successful exploitation.