This vulnerability affects Yot CMS up to versions 3.3.0 and 3.3.1. It involves the eval function in the modsys/console/admin.php file of the Admin Console component. Manipulating the 'text' argument passed to this function leads to code injection, enabling remote attackers to execute arbitrary code on the affected system. The vulnerability has been publicly disclosed, but there are no known exploits in the wild at this time. The CVSS 4.0 vector indicates network attack vector, low complexity, no user interaction, and requires high privileges.

Successful exploitation of this vulnerability allows remote attackers with high privileges to execute arbitrary code on the affected Yot CMS system. This can lead to unauthorized control over the system, potentially compromising data integrity and confidentiality. However, exploitation requires high privileges, which limits the attacker's initial access level.

No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict access to the Admin Console component to trusted users only and monitor for any suspicious activity involving the 'text' argument in modsys/console/admin.php.