CVE-2025-50881 affects the Use It Flow administration website prior to version 10.0.0. The vulnerability exists in the flow/admin/moniteur.php script, which processes the 'action' parameter from GET requests. The script uses eval() to execute a string constructed from this parameter after performing an insufficient validation that only checks the method name before the first parenthesis via method_exists(). This allows an attacker to append malicious PHP code after a valid method call, bypassing the validation and resulting in remote code execution. The flaw enables unauthenticated or low-privilege attackers to execute arbitrary PHP code on the server with the privileges of the web server process.

Successful exploitation allows an attacker to execute arbitrary PHP code remotely on the affected server, potentially leading to full compromise of the web server process. This includes the ability to read, modify, or delete data, execute system commands, and pivot within the network. The vulnerability requires no user interaction and has a low attack complexity. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the affected script to trusted users only and consider disabling or restricting the use of the vulnerable 'action' parameter. Avoid using eval() on user-supplied input and implement proper input validation and sanitization. Monitor vendor channels for updates and apply official patches once released.