A high-severity code injection vulnerability in the Silverstripe UserForms module allows authenticated users to execute arbitrary code, posing a critical risk to server integrity.

This is an improper control of generation of code vulnerability (CWE-94) where the userform email recipient subject field fails to sanitize input. An authenticated CMS user with administrative permissions to configure form recipients can inject executable code that the server interprets, leading to full system compromise.

The vulnerability carries a CVSS score of 8.8, reflecting its potential for total system compromise. Successful exploitation allows an attacker to gain remote code execution capabilities, which can lead to unauthorized data access, the installation of persistent backdoors, and total loss of availability for the affected CMS instance.

Immediate Action: Upgrade the silverstripe-userforms module to version 6.4.9, 7.0.7, or 7.1.1 immediately to incorporate the necessary input sanitization patches.

Proactive Monitoring: Review CMS audit logs for any unusual activity or modifications to form configurations, particularly those involving email recipient settings.

Compensating Controls: Restrict CMS access to the UserForms configuration interface to only the most trusted administrative accounts, and ensure that server-side file permissions prevent the web user from executing unauthorized scripts.

Public Exploit Available: No

Given the severity of this remote code execution vulnerability, organizations using the Silverstripe UserForms module must prioritize the update process. Administrators should verify their current version and apply the recommended patches immediately to neutralize the risk of unauthorized code execution.