An authenticated remote command execution vulnerability in 4images 1.9 allows administrative users to execute arbitrary code on the underlying server via template manipulation.

This vulnerability is a code injection flaw (CWE-94) located in the template editing functionality. It requires an authenticated administrator to inject and save a reverse shell payload, which is then triggered by accessing the categories.php endpoint.

The ability to execute arbitrary commands at the administrative level grants an attacker full control over the web application server. This poses a severe risk of data exfiltration, total system compromise, and potential lateral movement into the internal network. With a CVSS score of 8.8, this high-severity flaw represents a critical threat to the confidentiality, integrity, and availability of the affected environment.

Immediate Action: There is no official patch mentioned; administrators should restrict access to the administrative panel to trusted internal networks and consider migrating away from 4images 1.9 if updates are not provided by the vendor.

Proactive Monitoring: Review web server access logs for suspicious requests targeting the admin/templates.php file or unusual activity involving the categories.php endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block common reverse shell signatures and restrict access to the administrative management interface to authorized IP addresses only.

Public Exploit Available: Yes, a public proof-of-concept exists as documented on Exploit-DB (EDB-ID: 51147).

Given the severity of this remote command execution flaw and the existence of a public exploit, organizations currently running 4images 1.9 must take immediate action. Restrict administrative access to the application and monitor for signs of unauthorized template modifications, as attackers will likely attempt to weaponize this vulnerability to establish persistent backdoors.