CVE-2025-50881

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2025-50881", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-07-05T16:15:17.892Z", "dateReserved": "2025-06-16T00:00:00.000Z", "datePublished": "2026-03-16T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-07-05T16:15:17.892Z"}, "descriptions": [{"lang": "en", "value": "The `flow/admin/moniteur.php` script in Use It Flow administration website before 10.0.0 is vulnerable to Remote Code Execution. When handling GET requests, the script takes user-supplied input from the `action` URL parameter, performs insufficient validation, and incorporates this input into a string that is subsequently executed by the `eval()` function. Although a `method_exists()` check is performed, it only validates the part of the user input *before* the first parenthesis `(`, allowing an attacker to append arbitrary PHP code after a valid method call structure. Successful exploitation allows an unauthenticated or trivially authenticated attacker to execute arbitrary PHP code on the server with the privileges of the web server process."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/0xdeadbit/CVE-2025-50881"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-17T13:57:25.812091Z", "id": "CVE-2025-50881", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-17T13:59:00.502Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-50881", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-17T13:57:25.812091Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-17T13:58:42.287Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/0xdeadbit/CVE-2025-50881"}], "descriptions": [{"lang": "en", "value": "The `flow/admin/moniteur.php` script in Use It Flow administration website before 10.0.0 is vulnerable to Remote Code Execution. When handling GET requests, the script takes user-supplied input from the `action` URL parameter, performs insufficient validation, and incorporates this input into a string that is subsequently executed by the `eval()` function. Although a `method_exists()` check is performed, it only validates the part of the user input *before* the first parenthesis `(`, allowing an attacker to append arbitrary PHP code after a valid method call structure. Successful exploitation allows an unauthenticated or trivially authenticated attacker to execute arbitrary PHP code on the server with the privileges of the web server process."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-07-05T16:15:17.892Z"}}}, "cveMetadata": {"cveId": "CVE-2025-50881", "state": "PUBLISHED", "dateUpdated": "2026-07-05T16:15:17.892Z", "dateReserved": "2025-06-16T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-03-16T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The `flow/admin/moniteur.php` script in Use It Flow administration website before 10.0.0 is vulnerable to Remote Code Execution. When handling GET requests, the script takes user-supplied input from the `action` URL parameter, performs insufficient validation, and incorporates this input into a string that is subsequently executed by the `eval()` function. Although a `method_exists()` check is performed, it only validates the part of the user input *before* the first parenthesis `(`, allowing an attacker to append arbitrary PHP code after a valid method call structure. Successful exploitation allows an unauthenticated or trivially authenticated attacker to execute arbitrary PHP code on the server with the privileges of the web server process."}, {"lang": "es", "value": "El script `flow/admin/moniteur.php` en el sitio web de administraci\u00f3n de Use It Flow anterior a 10.0.0 es vulnerable a ejecuci\u00f3n remota de c\u00f3digo. Al manejar solicitudes GET, el script toma la entrada proporcionada por el usuario del par\u00e1metro URL `action`, realiza una validaci\u00f3n insuficiente e incorpora esta entrada en una cadena que es ejecutada posteriormente por la funci\u00f3n `eval()`. Aunque se realiza una verificaci\u00f3n `method_exists()`, solo valida la parte de la entrada del usuario *antes* del primer par\u00e9ntesis `(`, permitiendo a un atacante a\u00f1adir c\u00f3digo PHP arbitrario despu\u00e9s de una estructura de llamada a m\u00e9todo v\u00e1lida. La explotaci\u00f3n exitosa permite a un atacante no autenticado o trivialmente autenticado ejecutar c\u00f3digo PHP arbitrario en el servidor con los privilegios del proceso del servidor web."}], "id": "CVE-2025-50881", "lastModified": "2026-07-05T17:17:15.173", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-50881", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-17T13:57:25.812091Z", "version": "2.0.3"}}]}, "published": "2026-03-16T21:16:16.670", "references": [{"source": "cve@mitre.org", "url": "https://github.com/0xdeadbit/CVE-2025-50881"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,10.0.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "use_it_flow", "vendor": "api"}], "analysis": {"en": {"generated_at": "2026-03-17T16:50:50.029073+00:00", "value": {"mitigation_remediation": ["Upgrade Use It Flow administration to version 10.0.0 or later", "If an upgrade is not feasible, restrict access to the flow/admin/moniteur.php endpoint to trusted users only", "Implement input sanitization to prevent eval execution or disable the eval functionality", "Apply a web application firewall rule that blocks unexpected PHP code execution", "Verify the web server runs with the least privilege and consider isolating the admin application"], "summary": {"action": "Apply Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The flaw affects the Use It Flow administration application on all releases earlier than version\u00a010.0.0. No vendor or product identifier is listed in the CNA data, but references point to the Use It Flow site. Systems deploying the legacy admin module with direct access to flow/admin/moniteur.php are vulnerable.", "description_and_impact": "The vulnerability stems from insufficient validation of the action GET parameter in the flow/admin/moniteur.php script of the Use It Flow administration interface. The script performs a method_exists() check only before the first parenthesis, then appends the rest of the input to a string that is evaluated by eval(). An attacker can therefore inject arbitrary PHP code after a valid method call, resulting in remote code execution. This flaw permits an unauthenticated or trivially authenticated attacker to run arbitrary code with the privileges of the web server, compromising confidentiality, integrity, and availability.", "risk_and_exploitability": "The CVSS score of 8.8 classifies the vulnerability as high severity, though the EPSS score is below 1%, indicating low likelihood of current exploitation in the wild. The flaw is not yet listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by issuing a crafted HTTP GET request to the vulnerable script; no special privilege or network restrictions are required. Given the wide-reaching impact and the simple attack vector, immediate action is warranted."}}}}, "created": "2026-03-17T09:55:27.152679+00:00", "title": "Use It Flow Admin Remote Code Execution via Unsanitized eval in action Parameter", "updated": "2026-03-23T14:01:05.048683+00:00", "vendors": ["api", "api$PRODUCT$use_it_flow"]}