Threats affecting pkg:composer/pagekit/cms

Pagekit CMS version 1.0.18 has a privilege escalation vulnerability that allows authenticated users with the 'user: manage users' permission to assign arbitrary custom roles to themselves. This occurs due to missing authorization checks in the UserApiController::saveAction() method. Exploiting this flaw, attackers can grant themselves a custom role with the 'system: manage packages' permission, enabling them to upload and install malicious PHP packages via the admin package installer, potentially leading to remote code execution.

A weakness has been identified in Pagekit CMS up to 1.0.18. This issue affects the function evaluate of the file app/modules/view/src/PhpEngine.php of the component StringStorage Template Handler. This manipulation causes improper neutralization of directives in dynamically evaluated code. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.