An authenticated remote code execution vulnerability in Daylight Studio FuelCMS allows authorized users to execute arbitrary commands, posing a high risk to application integrity.

This is an authenticated remote code execution vulnerability located in the Installer.php controller. An attacker with valid user credentials can trigger the flaw via the add_git_submodule function to execute system commands on the underlying host.

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary code with the privileges of the web server. This can lead to full system compromise, unauthorized data access, and potential lateral movement within the network. With a CVSS score of 8.3, this flaw is categorized as High severity, necessitating immediate attention to prevent unauthorized administrative control.

Immediate Action: Since a specific patch is not currently identified, administrators should restrict access to the FuelCMS administrative interface and disable the Installer module if it is not strictly required.

Proactive Monitoring: Security teams should review web server access logs for suspicious requests targeting the /controllers/Installer.php endpoint, particularly those involving git submodule operations.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized or anomalous POST requests directed at the Installer controller.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the technical write-up referenced by the CVE record.

Given the High severity of this remote code execution flaw and the existence of a public proof-of-concept, organizations running FuelCMS version 1.5.2 must prioritize mitigation. Restrict access to the application immediately and monitor for unauthorized activity while awaiting an official vendor patch.