Tiny MoxieManager PHP Remote Code Execution Vulnerability in Installer Command

A remote code execution vulnerability has been identified in Tiny MoxieManager PHP versions prior to 4.0.0. This issue arises in the installer command, where unauthenticated attackers can inject and execute arbitrary code. The vulnerability allows attacker-controlled data to be inserted into the config.php file via the InstallCommand, which is accessible after the installation process is complete.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server where Tiny MoxieManager is installed.

Remediation

Users are advised to update to Tiny MoxieManager PHP version 4.0.0 or later, where this vulnerability has been patched. Additionally, the 'install' directory should be manually deleted after installation to prevent exploitation.