A critical remote code execution vulnerability in Creacast Creabox Manager 4.4.4 allows authenticated attackers to gain full system control.

The vulnerability exists in the edit.php endpoint, where an authenticated attacker can inject arbitrary Lua code into the system configuration. This input is processed by the server, leading to execution of commands or reverse shells with the privileges of the application.

The ability to execute arbitrary code on the server represents a total system compromise, potentially leading to unauthorized data access, lateral movement within the network, or complete service disruption. Given the high CVSS score of 8.8, this flaw poses a significant risk to the confidentiality, integrity, and availability of the affected environment. Organizations relying on Creabox Manager for critical infrastructure or content delivery should treat this as a high-priority incident.

Immediate Action: Contact Creacast support or monitor the official vendor portal for the release of a security patch addressing this code injection flaw.

Proactive Monitoring: Review web server access logs for suspicious requests targeting the edit.php endpoint and monitor server process logs for unexpected Lua script executions or unauthorized spawned shells.

Compensating Controls: Implement strict network access controls to limit access to the Creabox Manager interface and deploy a Web Application Firewall (WAF) to inspect and block malicious payloads directed at the edit.php endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the researcher's write-up referenced in the CVE record.

Due to the severity of remote code execution and the availability of technical details regarding the exploit, immediate attention is required. Administrators should restrict access to the vulnerable interface while awaiting an official vendor patch to ensure the security of the host system.