A critical unauthenticated remote code execution vulnerability in GravCMS 1.10.7 poses a severe risk of total system compromise.

This is an unauthenticated missing authorization flaw (CWE-862) within the scheduler endpoint, allowing attackers to inject malicious custom jobs and execute arbitrary system commands via base64-encoded PHP payloads.

Successful exploitation of this vulnerability allows an unauthenticated attacker to achieve full remote code execution on the underlying server. Given the CVSS score of 7.5, this flaw presents a high risk to business operations, as it can lead to total data exfiltration, unauthorized system control, and potential lateral movement within the network.

Immediate Action: Upgrade GravCMS to the latest version immediately to resolve the authorization flaw in the scheduler component.

Proactive Monitoring: Review web server and application logs for suspicious POST requests targeting the /admin/config/scheduler endpoint, especially those containing base64-encoded strings or references to command execution functions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized access to the administration panel and sanitize input parameters associated with the scheduler tool.

Public Exploit Available: Yes, a functional exploit script is available via ExploitDB (EDB-ID 49973).

The vulnerability in GravCMS 1.10.7 is severe due to the lack of required authentication for critical administrative functions. Organizations running this version must prioritize patching to prevent potential remote code execution. If patching is not immediately feasible, restrict access to the /admin interface to trusted network segments to mitigate the risk of unauthorized exploitation.