CVE-2026-27174

MajorDoMo Unauthenticated Remote Code Execution via Admin Console Eval

View on CVE.org
Published Feb 18, 2026 CVSS 4.0 · 9.3 Critical EPSS 6.9% KEV · Not listed
Description
MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature. An include order bug in modules/panel.class.php causes execution to continue past a redirect() call that lacks an exit statement, allowing unauthenticated requests to reach the ajax handler in inc_panel_ajax.php. The console handler within that file passes user-supplied input from GET parameters (via register_globals) directly to eval() without any authentication check. An attacker can execute arbitrary PHP code by sending a crafted GET request to /admin.php with ajax_panel, op, and command parameters.

Analysis

AI-generated

Technical impact

The vulnerability is triggered by the admin panel’s PHP console feature. An include order bug in modules/panel.class.php bypasses a redirect() call that lacks an exit, allowing unauthenticated requests to reach the ajax handler in inc_panel_ajax.php. The console handler in that file passes user-supplied GET parameters directly to eval() without any authentication check, enabling an attacker to execute arbitrary PHP code on the server.

Affected Systems

The affected product is MajorDoMo by sergejey. No specific version information is provided; the flaw applies to any installation that contains the vulnerable modules/panel.class.php and inc_panel_ajax.php.

Risk and Exploitability

With a CVSS score of 9.3 and an EPSS of 7%, the risk of exploitation is high. The exploit requires only unauthenticated HTTP GET requests to a predictable URL (e.g., /admin.php?ajax_panel=1&op=…&command=…) and relies on PHP’s register_globals being enabled and the absence of authentication checks. The vulnerability is not listed in the CISA KEV catalog, but the path to remote code execution is straightforward and has been publicly demonstrated.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest patch to MajorDoMo that removes the unsanitized eval usage, as referenced in sergejey/majordomo pull request 1177.
  • Restrict web access to the /admin.php endpoint so that only authenticated users can reach it, for example by implementing HTTP authentication or IP whitelisting and ensuring the application enforces authentication before processing console commands.
  • If a patch is not yet available, disable the console feature by removing or commenting out the ajax_panel handling code in inc_panel_ajax.php, or block the ajax_panel GET parameter so the eval call is unreachable.
  • Additionally, disable register_globals in the PHP environment to prevent accidental global variable injection that could be exploited.

Generated by OpenCVE AI on October 25, 2026 at 22:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Mjdm
Mjdm majordomo
CPEs cpe:2.3:a:mjdm:majordomo:-:*:*:*:*:*:*:*
Vendors & Products Mjdm
Mjdm majordomo
Type Values Removed Values Added
Description MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature. An include order bug in modules/panel.class.php causes execution to continue past a redirect() call that lacks an exit statement, allowing unauthenticated requests to reach the ajax handler in inc_panel_ajax.php. The console handler within that file passes user-supplied input from GET parameters (via register_globals) directly to eval() without any authentication check. An attacker can execute arbitrary PHP code by sending a crafted GET request to /admin.php with ajax_panel, op, and command parameters.
Title MajorDoMo Unauthenticated Remote Code Execution via Admin Console Eval
First Time appeared Sergejey
Sergejey majordomo
Weaknesses CWE-94
CPEs cpe:2.3:a:sergejey:majordomo:*:*:*:*:*:*:*:*
Vendors & Products Sergejey
Sergejey majordomo
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}
Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')

Sources

Status
PUBLISHED
Assigner
VulnCheck
Published
Updated
Nov 8, 2026, 2:01 PM
Reserved
Feb 18, 2026, 3:22 PM

View source JSON

Updated
Feb 25, 2026, 6:21 PM

JSON

Status
Analyzed
Published
Feb 18, 2026, 10:16 PM
Modified
Jun 17, 2026, 10:26 AM

View source JSON

No data.

Updated
Oct 25, 2026, 10:15 PM

JSON