cbcvebase.
CVE-2013-10051
published 2025-08-01

CVE-2013-10051: A remote PHP code execution vulnerability exists in InstantCMS version 1.6 and earlier due to unsafe use of eval() within the search view handler…

PriorityP272critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
1.89%
77.0th percentile
A remote PHP code execution vulnerability exists in InstantCMS version 1.6 and earlier due to unsafe use of eval() within the search view handler. Specifically, user-supplied input passed via the look parameter is concatenated into a PHP expression and executed without proper sanitation. A remote attacker can exploit this flaw by sending a crafted HTTP GET request with a base64-encoded payload in the Cmd header, resulting in arbitrary PHP code execution within the context of the web server.

Affected

1 ranges
VendorProductVersion rangeFixed in
instantcmsinstantcms<= 1.6.0—

Detection & IOCsextracted from sources · hover to see the quote

versionInstantCMS 1.6↗
otherlook (GET parameter)↗
otherCmd (HTTP header, base64-encoded payload)↗
  • →Monitor HTTP GET requests targeting the InstantCMS search view handler that include a 'look' parameter containing suspicious or encoded content, particularly base64-encoded strings. ↗
  • →Alert on HTTP requests containing a non-standard 'Cmd' header, especially when the value appears base64-encoded, as this is the delivery mechanism for the RCE payload against InstantCMS. ↗
  • →Detect exploitation attempts via the Metasploit module path unix/webapp/instantcms_exec in proxy or IDS logs, indicating use of a known public exploit framework module. ↗
  • ·The vulnerability is rooted in unsafe use of eval() on user-supplied input in the search view handler; any InstantCMS deployment on version 1.6 or earlier is affected regardless of configuration. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.