CVE-2013-10051 InstantCMS <= 1.6 Remote PHP Code Execution
Remote attackers can execute arbitrary PHP code via unsafe eval() in the search handler, compromising the web server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2013-10051?
CVE-2013-10051 is a critical code injection vulnerability in InstantCMS, published on 1 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A remote PHP code execution vulnerability exists in InstantCMS version 1.6 and earlier due to unsafe use of eval() within the search view handler. Specifically, user-supplied input passed via the look parameter is concatenated into a PHP expression and executed without proper sanitation. A remote attacker can exploit this flaw by sending a crafted HTTP GET request with a base64-encoded payload in the Cmd header, resulting in arbitrary PHP code execution within the context of the web server.
Weakness: CWE-95
Which versions are affected by CVE-2013-10051?
It affects 1 product.
Products include Instantcms Instantcms.
How do I fix CVE-2013-10051?
No fix has been published for CVE-2013-10051 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2013-10051 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2013-10051 exists.
Public exploit code: 1 Metasploit module.
Other vulnerabilities in InstantCMS
- CVE-2023-4188 SQL Injection in instantsoft/icms2
- CVE-2023-4704 External Control of System or Configuration Setting in instantsoft/icms2
- CVE-2026-28281 InstantCMS has Multiple CSRF Vulnerabilities
- CVE-2023-4652 Cross-site Scripting (XSS) - Stored in instantsoft/icms2
- CVE-2024-31212 SQL injection in index_chart_data action
Sources
Also known as GHSA-vv4j-q4m2-9gr7.