HAX CMS helps manage microsite universe with PHP or NodeJs backends. The PHP version of HAX CMS prior to version 26.0.0 has an authenticated file overwrite vulnerability. An attacker can exploit this vulnerability to configure malicious Git filter commands and achieve code execution on the HAX CMS server. Version 26.0.0 patches the issue.
An authenticated user can exploit the file overwrite vulnerability (authenticated file overwrite) to modify Git configuration by injecting malicious commands as Git filter commands (Git filter commands). When the configured filters are executed by the server, the injected commands are executed in the context of the HAX CMS server process. This is a classic command injection scenario (CWE-78) resulting from insufficient control over externally configurable parameters (CWE-15, CWE-73).
An attacker with access to a user account can obtain remote code execution (RCE) on the HAX CMS server, which may lead to complete server takeover, data theft, and further lateral movement in the network.
HAX CMS PHP version should be updated to version 26.0.0, which contains a patch addressing the described issue. Details available in the vendor references: https://github.com/haxtheweb/issues/security/advisories/GHSA-q759-vxg8-vq5j
HAX CMS PHP version earlier than 26.0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X