The vulnerability exists in the admin template editor component (application/admin/controller/Template.php) of magicblack maccms10. The editor attempts to block dangerous PHP functions using a blacklist regex, but this blacklist fails to include several dangerous functions including exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log. This omission enables an attacker with administrative privileges to perform code injection by embedding these functions in template content, potentially leading to full compromise of confidentiality, integrity, and availability of the system. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, required privileges (high), no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. No patch or official remediation is currently documented.

Successful exploitation allows an attacker with administrative privileges to execute arbitrary PHP code on the server hosting maccms10. This can lead to complete system compromise including data theft, data modification, and service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrative access to trusted users only and consider disabling the template editor if possible to reduce risk.