CVE-2011-4932: ImpressPages CMS Eval Injection Vulnerability
Summary
CVE-2011-4932: ImpressPages CMS eval injection vulnerability. Affects impresspages/impresspages versions < 1.0.13. Fixed in 1.0.13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ImpressPages CMS is an open-source content management system designed for simplicity and flexibility in website creation and management. It offers a user-friendly interface, modular architecture, and a wide range of features that allow users to easily manage their website content. However, versions prior to 1.0.13 are susceptible to a critical eval injection vulnerability that can be exploited by remote attackers.
Vulnerability Detail
The eval injection vulnerability exists in the 'ip_cms/modules/standard/content_management/actions.php' file of ImpressPages CMS version 1.0.12 and potentially earlier versions. This flaw allows attackers to execute arbitrary code by manipulating the 'cm_group' parameter. If exploited, this vulnerability can lead to unauthorized access, data breaches, and complete control over the affected system, posing significant risks to the integrity and confidentiality of the application.
How To Fix
Minimum fixed version
1.0.13
This is the first release that contains the fix.
composer require impresspages/impresspages:1.0.13Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate update is not feasible, consider restricting access to the affected module or implementing input validation to sanitize the 'cm_group' parameter. However, these workarounds do not fully mitigate the risk and should only be temporary measures until the update is applied.
Conclusion
The eval injection vulnerability in ImpressPages CMS poses a significant threat to users of versions prior to 1.0.13. It is crucial to update to the latest version to safeguard against potential exploitation. Users are encouraged to utilize tools like Vulert for real-time monitoring of vulnerabilities in their applications.
See every vulnerability recorded for impresspages/impresspages →
FAQ
The eval injection vulnerability allows attackers to execute arbitrary PHP code by manipulating input parameters, which can lead to severe security breaches.
ImpressPages CMS versions prior to 1.0.13 are affected by this vulnerability, with version 1.0.12 being specifically mentioned.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to unauthorized access, data loss, and complete control over the affected system, posing significant risks to users and data integrity.
While the best solution is to update to the patched version, temporary workarounds include restricting access to the affected module and validating input parameters.
Related vulnerabilities
Recent vulnerabilities recorded for impresspages/impresspages.
