This vulnerability in RooCMS up to versions 1.2.2, 1.3.4, and 1.4RC2 involves improper handling of the content argument passed to the eval function in roocms/site_pagePHP.php. This leads to code injection, enabling remote attackers to execute arbitrary code on the affected system. The vulnerability has a CVSS 4.0 score of 5.1 (medium severity) with network attack vector, low complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability. The vendor has not issued any patch or advisory, and the exploit code is publicly available.

Successful exploitation allows remote attackers to execute arbitrary code on the affected RooCMS server, potentially compromising the system. The impact is rated medium severity based on CVSS 4.0 scoring. There is no indication of active exploitation in the wild at this time.

No official fix or patch is currently available from the vendor. Users should consider disabling or restricting access to the vulnerable component or the eval function usage in roocms/site_pagePHP.php as a temporary mitigation. Monitor for any future vendor advisories or patches. Due to the public disclosure of exploit code, affected systems should be considered at risk until remediation is applied.