The vulnerability stems from insufficient validation of the action GET parameter in the flow/admin/moniteur.php script of the Use It Flow administration interface. The script performs a method_exists() check only before the first parenthesis, then appends the rest of the input to a string that is evaluated by eval(). An attacker can therefore inject arbitrary PHP code after a valid method call, resulting in remote code execution. This flaw permits an unauthenticated or trivially authenticated attacker to run arbitrary code with the privileges of the web server, compromising confidentiality, integrity, and availability.

The flaw affects the Use It Flow administration application on all releases earlier than version 10.0.0. No vendor or product identifier is listed in the CNA data, but references point to the Use It Flow site. Systems deploying the legacy admin module with direct access to flow/admin/moniteur.php are vulnerable.

The CVSS score of 8.8 classifies the vulnerability as high severity, though the EPSS score is below 1%, indicating low likelihood of current exploitation in the wild. The flaw is not yet listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by issuing a crafted HTTP GET request to the vulnerable script; no special privilege or network restrictions are required. Given the wide-reaching impact and the simple attack vector, immediate action is warranted.