An unauthenticated remote code execution vulnerability in MetInfo CMS allows attackers to gain full control over affected web servers.

This is a critical code injection vulnerability (CWE-94) resulting from insufficient input neutralization. The flaw allows unauthenticated remote attackers to send crafted requests to execute arbitrary PHP code on the server.

With a CVSS score of 9.8, this vulnerability allows for complete system compromise. The impact includes unauthorized access to sensitive data, potential lateral movement within the network, and the deployment of persistent backdoors, posing a severe threat to business continuity and data privacy.

Immediate Action: Update MetInfo CMS to the latest version provided by the vendor. If an update is unavailable, take the affected web application offline until a patch is applied.

Proactive Monitoring: Review web server access logs for suspicious requests containing PHP syntax or encoded payloads.

Compensating Controls: Implement strict input validation at the WAF level to block common PHP injection patterns and ensure the application runs with the least privilege necessary.

Public Exploit Available: Yes (Nuclei detection template exists).

The combination of unauthenticated access and remote code execution makes this a high-priority incident. Organizations running MetInfo CMS must verify their version and apply the required updates immediately to neutralize the risk of server takeover.