An authenticated remote code execution vulnerability in Camaleon CMS allows attackers to inject malicious code, leading to total system compromise.

This is a code injection vulnerability (CWE-94) triggered by the improper control of code generation within the select_eval custom field. The exploit requires an attacker to have authenticated access to the application.

Successful exploitation allows an attacker to execute arbitrary code on the underlying server, resulting in complete system compromise, data theft, or malware deployment. Given the CVSS score of 8.8, this is a critical threat to any organization hosting the affected software.

Immediate Action: Update to the latest version of Camaleon CMS as specified by the vendor to remove the vulnerable select_eval functionality.

Proactive Monitoring: Inspect server logs for suspicious system calls or unexpected processes originating from the web application user.

Compensating Controls: Deploy a Web Application Firewall with rules designed to detect and block malicious code injection patterns in HTTP requests.

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub.

Given the existence of a public proof-of-concept and the severity of remote code execution, organizations must prioritize patching this vulnerability immediately. Failure to do so leaves the infrastructure exposed to potential full system takeover.