FoxCMS Code Execution Vulnerability in Template File Editing

A code execution vulnerability exists in FoxCMS versions through 1.2.5, specifically within the admin/template_file/editFile.html file. The issue arises from inadequate filtering of PHP short tags and potentially dangerous functions, allowing malicious scripts to be injected and executed.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server.

Reproduction

To reproduce this vulnerability, navigate to the template file editing feature in the admin panel. Select a template file, such as index.html, and inject a malicious script into it. After submitting the changes, the injected script will be executed, demonstrating successful exploitation.