External risk intelligence

Pegasus CMS 1.0 Remote Code Execution via Extra Fields Plugin

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2019-25687

The vulnerability affects a Content Management System (CMS), which is a web application typically deployed as a public-facing service. The flaw resides in a web endpoint reachable via POST requests, making it likely to be exposed to the internet in common deployment scenarios.

Path Traversal

Wisdom Pegasus Cms

1.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical security vulnerability in Pegasus CMS, a type of content management software. The issue involves a flaw in a plugin that could allow unauthorized remote execution of commands, potentially leading to a compromise of the system. The main concern is to confirm if this specific software is in use and if it is exposed externally.

Unauthenticated attackers can run commands remotely.
Confirms if this software is in use and exposed.
Assess relevance and confirm exposure to this risk.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit a remote code execution vulnerability in the Pegasus CMS `extra_fields.php` plugin. By sending a crafted POST request to the `submit.php` endpoint, an attacker can inject malicious PHP code into the `action` parameter. This can lead to arbitrary command execution on the server, potentially allowing the attacker to gain an interactive shell.

No authentication required to trigger.
Malicious PHP code in POST request.
Server-side command execution and shell access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect the behavior and integrity of the Pegasus CMS, potentially allowing attackers to execute arbitrary commands on the server. This could occur when the extra_fields.php plugin's submit.php endpoint is accessed with specially crafted POST requests containing malicious PHP code.

Server command execution.
Unauthenticated POST requests.
System compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Pegasus CMS 1.0's remote code execution vulnerability impacts application owners and platform teams responsible for the CMS. The initial step is to identify all Pegasus CMS instances, confirm their accessibility, and determine business criticality to prioritize remediation efforts with the accountable owner.

Identify CMS instances and owners.
Verify external reachability and impact.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Pegasus CMS?

Pegasus CMS is a content management system developed by Wisdom used to organize and publish digital content. It acts as a framework for managing website structure and data, often relying on plugins to extend its base functionality. This specific vulnerability involves a component called the extra_fields.php plugin, which adds custom data handling capabilities to the platform.

What does CVE-2019-25687 mean for security?

This vulnerability is classified as Improper Limitation of a Pathname to a Restricted Directory, or CWE-22, which in this context allows for Remote Code Execution. Essentially, the software fails to properly sanitize user input before processing it. Because the application uses an unsafe eval-like function to handle data, an attacker can supply their own PHP commands, forcing the server to execute malicious code on their behalf.

How is this vulnerability triggered?

An attacker triggers this by sending a specially crafted POST request to the submit.php file within the affected plugin. By injecting arbitrary PHP instructions into the action parameter, the code is executed directly by the server. Note that this attack does not require a valid login; however, it specifically targets this endpoint, meaning requests that do not target the vulnerable submit.php interface or fail to use the correct parameter do not trigger the flaw.

Is my instance of Pegasus CMS at risk?

According to Halo Surface Signal, this vulnerability is likely to affect systems exposed to the internet because Pegasus CMS is a web-based application. If your instance is reachable from the public internet, it faces a higher risk of being targeted. Internal-only instances still face risk from malicious actors already inside your network, but internet-facing deployments are the primary concern for this type of network-based exploit.

What should I do if I run Pegasus CMS 1.0?

First, conduct an inventory to locate all instances of Pegasus CMS 1.0 within your environment. Once identified, verify if the systems are accessible from the internet and evaluate their business criticality. Coordinate with the platform owners to restrict access to the affected submit.php endpoint or isolate the vulnerable instances while you determine the appropriate remediation steps.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.