External risk intelligence

lmxcms Remote Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-46958

The vulnerability resides in a CMS (Content Management System) application which is typically deployed as a web-facing service to manage website content. Because these applications are designed to be accessible over the network to serve web traffic, they are commonly exposed to the internet in real-world deployments.

Code Injection

Lmxcms

1.41

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An unauthenticated remote attacker could execute arbitrary code on systems running lmxcms due to a vulnerability in the admin.php file. This could allow an attacker to take control of affected systems. The main concern is confirming relevance and exposure.

Unauthenticated code execution is a severe risk.
CMS systems often manage critical public-facing content.
Confirm if this system is in use and exposed.

Attack Path

How an attacker could exploit the issue

An attacker can send a specially crafted script to the `admin.php` file of an `lmxcms` application. This malicious input can lead to arbitrary code execution on the affected system.

No authentication required.
Sending a crafted script to `admin.php`.
Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker could execute arbitrary code by sending a specially crafted script to the `admin.php` file. This could affect the integrity and availability of the system, and potentially lead to the compromise of any data managed by the affected system.

System code execution.
Via crafted script to admin file.
Data compromise and service disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in lmxcms, allowing remote code execution, requires immediate attention. Application owners and infrastructure teams should collaborate to identify all instances of lmxcms, assess their business criticality and external reachability, and confirm the accountable owner. Planning remediation efforts should then proceed based on the determined risk.

Application owners and infrastructure teams own remediation.
Verify external reachability and business criticality.
Plan remediation based on verified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is lmxcms?

lmxcms is a content management system used to build and maintain websites. It functions as the backend platform where administrators manage pages, posts, and media. Because it handles website structure and dynamic content, it is typically installed on web servers to interact with public internet traffic.

What does CWE-94 mean for CVE-2023-46958?

CWE-94 refers to the improper control of generation of code. In the context of CVE-2023-46958, it means the software incorrectly handles user-supplied data, allowing an attacker to inject and execute their own unauthorized commands. Essentially, the application accidentally treats external input as valid system instructions.

How is this vulnerability triggered?

An attacker triggers this flaw by sending a specifically formatted script to the admin.php file within the lmxcms application. This action does not require the attacker to have a valid username or password to the system. Standard navigation or non-malicious use of the administrative interface will not trigger this vulnerability.

Is my instance of lmxcms at risk?

Halo Surface Signal indicates that because lmxcms is a web-based CMS, it is frequently deployed to be reachable over the internet. If your instance is exposed to the public web, it is at higher risk because remote attackers can reach the vulnerable admin.php file directly. Instances restricted to an internal-only network have a smaller attack surface, but remain vulnerable if an attacker gains access to your internal network.

What should I do if I run lmxcms?

First, locate all running instances of lmxcms within your infrastructure. Once you have an inventory, determine which systems are reachable from the internet versus those isolated internally. Coordinate with your team to prioritize these assets based on their role and business impact, then develop a plan to update or replace the affected software version to eliminate the vulnerability.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.