Technical impact
MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code on the web server. By sending crafted HTTP requests that embed malicious PHP code, an attacker can achieve remote code execution and gain full control over the affected server. The weakness arises from insufficient input neutralization during execution, classified as CWE‑94, and can lead to loss of confidentiality, integrity, and availability for the target system.
Affected Systems
The vulnerability affects the MetInfo CMS product, specifically releases 7.9, 8.0.0, and 8.1. System administrators should verify whether their deployments run any of these versions.
Risk and Exploitability
With a CVSS score of 9.3 and an EPSS probability of 39%, the risk remains high due to the critical impact, reflecting a high likelihood of exploitation. It is likely that an attacker can exploit this flaw by sending unauthenticated HTTP requests containing malicious PHP code, making the attack surface broad. The vulnerability is not listed in the CISA KEV catalog, but its severity warrants immediate action.
