In Tiny MoxieManager PHP before 4.0.0, remote code execution can occur in the installer command. This vulnerability allows unauthenticated attackers to inject and execute arbitrary code. Attacker-controlled data to InstallCommand can be inserted into config.php, and InstallCommand is available after an installation has completed.
An attacker can pass attacker-controlled data to the InstallCommand mechanism, which writes it directly to the config.php configuration file. Since the injected data reaches the PHP file without proper validation or sanitization (CWE-96 — indirect static code injection), the code embedded this way is subsequently executed by the server. Critical is the fact that the InstallCommand endpoint remains available even after successful installation completion, which extends the vulnerability window to all active installations.
An unauthenticated attacker can remotely execute arbitrary code on the server hosting the application, which in practice means complete system takeover, data theft capability, backdoor installation, and further lateral movement within the network.
Tiny MoxieManager PHP must be immediately updated to version 4.0.0 or later. Details regarding the patch are available in the vendor's changelog and security bulletin SEC-1063 on moxiemanager.com. Until the update is applied, it is recommended to block access to the InstallCommand endpoint at the firewall or web server configuration level.
Tiny MoxieManager PHP in all versions prior to 4.0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X