The vulnerability is triggered by the admin panel’s PHP console feature. An include order bug in modules/panel.class.php bypasses a redirect() call that lacks an exit, allowing unauthenticated requests to reach the ajax handler in inc_panel_ajax.php. The console handler in that file passes user-supplied GET parameters directly to eval() without any authentication check, enabling an attacker to execute arbitrary PHP code on the server.

The affected product is MajorDoMo by sergejey. No specific version information is provided; the flaw applies to any installation that contains the vulnerable modules/panel.class.php and inc_panel_ajax.php.

With a CVSS score of 9.3 and an EPSS of 85%, the risk of exploitation is high. The exploit requires only unauthenticated HTTP GET requests to a predictable URL (e.g., /admin.php?ajax_panel=1&op=…&command=…) and relies on PHP’s register_globals being enabled and the absence of authentication checks. The vulnerability is not listed in the CISA KEV catalog, but the path to remote code execution is straightforward and has been publicly demonstrated.