ImpressCMS 1.4.2 contains a remote code execution flaw in the autotasks administration interface. Authenticated users can inject malicious PHP code through the sat_code parameter in a POST request to /modules/system/admin.php?fct=autotasks&op=mod. The injected code is written to an executable file that accepts arbitrary commands via GET parameters, allowing full control over the web server. This enables attackers to read, modify, or delete data, gain root access, or use the server as a platform for further attacks.

The vulnerability affects the ImpressCMS content management system version 1.4.2, as identified by the cpe string cpe:2.3:a:impresscms:impresscms:1.4.2. No other versions were indicated in the CNA data. Administrators running this exact version should consider it exposed until a patch is applied.

The CVSS score of 8.7 reflects significant impact and a high exploitation likelihood for authenticated users. EPSS data is not available, so the current exploitation probability cannot be quantified, but the lack of a KEV listing does not reduce the risk, as the flaw remains publicly documented. Attackers must first authenticate to access the admin panel; however, once authenticated they can easily craft the sat_code payload and trigger arbitrary PHP code execution, making the threat immediate for sites with exposed admin interfaces.