An authenticated remote code execution vulnerability in the ImpressCMS custom tag module allows an administrator to execute arbitrary PHP code on the server.

This is a code injection vulnerability (CWE-94) triggered by the custom tag module. It requires an attacker to have administrative privileges to store a malicious payload, which is then executed when the PHP type is enabled.

The CVSS score of 7.2 underscores the severity of this remote code execution flaw. If an attacker gains administrative access, they can achieve full control over the application server, leading to complete system compromise, data theft, and the potential for lateral movement within the network.

Immediate Action: Review administrative access logs for unauthorized changes and monitor the custom tag module for suspicious PHP code entries while awaiting a formal vendor patch.

Proactive Monitoring: Perform integrity checks on the application codebase and monitor for the creation of unauthorized files or scripts on the web server.

Compensating Controls: Restrict administrative access to the ImpressCMS backend to trusted, multi-factor authenticated users and apply strict file system permissions to prevent the execution of untrusted scripts.

Public Exploit Available: Unknown

Although this vulnerability requires administrative access, the potential for remote code execution makes it a critical concern for ImpressCMS environments. Organizations should audit all administrative accounts and ensure that only authorized personnel have the capability to manage custom tags until a security update is released.