A vulnerability described as critical has been identified in iCMS up to 8.0.0. Affected is the function
Save of the file app/config/ConfigAdmincp.php of the component POST Parameter Handler. The manipulation of the argument config results in code injection.
This vulnerability is reported as CVE-2025-15394. The attack can be launched remotely. Moreover, an exploit is present.
The vendor was contacted early about this disclosure but did not respond in any way.
