CVE-2019-25687
Published: 05 April 2026
Description
Pegasus CMS 1.0 contains a remote code execution vulnerability in the extra_fields.php plugin that allows unauthenticated attackers to execute arbitrary commands by exploiting unsafe eval functionality. Attackers can send POST requests to the submit.php endpoint with malicious PHP code in…
more
the action parameter to achieve code execution and obtain an interactive shell.
Mitigating Controls (NIST 800-53 r5)AI
SI-2 requires identifying, reporting, and correcting flaws like the unsafe eval in extra_fields.php, directly remediating the RCE vulnerability.
SI-10 mandates validating inputs such as the malicious 'action' parameter to block arbitrary PHP code execution via eval.
CM-7 enforces least functionality by prohibiting or restricting the vulnerable extra_fields.php plugin, eliminating the attack surface.
Security SummaryAI
CVE-2019-25687 is a remote code execution vulnerability affecting Pegasus CMS version 1.0, specifically in the extra_fields.php plugin. The flaw stems from unsafe eval functionality, enabling unauthenticated attackers to execute arbitrary commands. It has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-22.
Unauthenticated attackers can exploit this vulnerability over the network with low complexity and no user interaction required. By sending POST requests to the submit.php endpoint with malicious PHP code in the action parameter, attackers achieve remote code execution and can obtain an interactive shell, granting high confidentiality, integrity, and availability impacts.
Advisories and references, including an Exploit-DB entry at https://www.exploit-db.com/exploits/46542, a VulnCheck advisory at https://www.vulncheck.com/advisories/pegasus-cms-remote-code-execution-via-extra-fields-php, and vendor information at https://www.wisdom.com.au/web/pegasus-cms, provide details on the issue, though specific patch or mitigation guidance is not detailed in the CVE description. Security practitioners should review these for remediation steps, such as upgrading the CMS or disabling the affected plugin.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2019-25687 enables unauthenticated remote code execution via unsafe eval in a public-facing web application (Pegasus CMS), directly facilitating T1190: Exploit Public-Facing Application.