External risk intelligence

TaoCMS Arbitrary PHP Code Injection in Website Settings.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2022-36262

taocms is a content management system designed to be deployed as a public-facing web application. Vulnerabilities in website settings or configuration interfaces for such systems are commonly accessible via the internet in standard deployments.

Code Injection

Taogogo Taocms

3.0.2

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An unspecified vulnerability in the website settings of taocms, a content management system, could allow unauthorized code injection. This issue is considered critical due to its potential for broad impact on affected systems. The primary concern is to confirm if your organization utilizes taocms and is therefore potentially exposed.

Allows code injection through website settings.
Critical risk for public-facing websites.
Confirm taocms use and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by accessing the website's settings without needing any prior authentication. By manipulating the configuration file, specifically `config.php`, they can inject arbitrary PHP code. This could allow them to compromise the server, execute malicious commands, or steal sensitive information.

No authentication required to start.
Modifying website settings triggers vulnerability.
Allows arbitrary PHP code injection.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject and execute arbitrary PHP code by modifying the `config.php` file within TaoCMS's website settings. This could lead to a compromise of the server hosting the application.

Arbitrary PHP code execution.
Modification of critical configuration files.
Server-side compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Understanding ownership and initial steps for this critical vulnerability in taocms requires identifying the teams responsible for web applications and their configurations. This typically falls to application owners or dedicated platform teams who manage the CMS, alongside infrastructure and security teams who monitor network exposure and implement controls. The first practical move is to confirm where taocms is deployed, assess its external reachability and business criticality, identify the accountable owner, and then plan remediation based on the risk profile.

Application owners must manage the issue.
Verify website reachability and business criticality first.
Plan remediation, coordinate vendor, or apply controls.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is taocms?

taocms is a content management system developed by taogogo. It is designed to manage website content and is typically deployed as a web application. Users rely on it to handle site structure and configuration, which involves storing settings in files like config.php.

What does CVE-2022-36262 mean for security?

This vulnerability is classified as CWE-94, or Improper Control of Generation of Code. In plain terms, it means the application fails to properly restrict input when saving website settings. Because of this weakness, an attacker can trick the system into accepting and storing malicious PHP code instead of legitimate configuration data, which the server will later execute.

How is this vulnerability triggered?

An attacker triggers this flaw by interacting with the website settings interface to modify the config.php file. Importantly, this does not require any prior authentication, meaning a user does not need to log in to the system to initiate the attack. Normal, legitimate use of the software for its intended administrative purposes does not cause this issue; it only occurs when unauthorized input is processed during the configuration change.

Is my instance of taocms at risk?

According to Halo Surface Signal, taocms is designed to be a public-facing web application. Because this vulnerability allows unauthenticated access to critical settings, any instance reachable over the internet is at a higher risk of being targeted. If your installation is not exposed to the public web, the likelihood of an external attacker reaching the vulnerable settings interface is lower, though the internal risk remains.

What should I do if I use taocms?

First, perform an inventory to locate all active deployments of taocms within your environment. Once identified, determine if the applications are exposed to the internet. Coordinate with the application owners to assess the business criticality of these sites and monitor for any suspicious changes to your configuration files. Finally, work with your security team to implement network controls while you plan for remediation.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.