CVE-2025-50881 Details
Description
The `flow/admin/moniteur.php` script in Use It Flow administration website before 10.0.0 is vulnerable to Remote Code Execution. When handling GET requests, the script takes user-supplied input from the `action` URL parameter, performs insufficient validation, and incorporates this input into a string that is subsequently executed by the `eval()` function. Although a `method_exists()` check is performed, it only validates the part of the user input *before* the first parenthesis `(`, allowing an attacker to append arbitrary PHP code after a valid method call structure. Successful exploitation allows an unauthenticated or trivially authenticated attacker to execute arbitrary PHP code on the server with the privileges of the web server process.
A remote code execution vulnerability has been identified in the Use It Flow administration website, specifically in versions prior to 10.0.0. The issue arises in the 'flow/admin/moniteur.php' script, which processes GET requests by taking user input from the 'action' URL parameter. The script performs inadequate validation and executes the input using the 'eval()' function. Although there is a 'method_exists()' check, it only verifies the input before the first parenthesis, allowing attackers to append arbitrary PHP code after a valid method name. Exploitation of this vulnerability enables unauthenticated or minimally authenticated attackers to execute arbitrary PHP code on the server with the same privileges as the web server process.
Users are advised to update to Use It Flow version 10.0.0 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Mar 16, 2026CISA-ADP
Assessed Mar 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/0xdeadbit/CVE-2025-50881 | [email protected] | ExploitTechnical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Use It Flow | All versions |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 5, 2026 | CVE Modified | [email protected] |
| Jul 5, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 17, 2026 | CVE Modified | CISA-ADP |
| Mar 16, 2026 | New CVE Received | [email protected] |