← back
CVE-2025-50567

CVE-2025-50567

CVSS 10 CRITICALEPSS 0.7%CWE-89CWE-94
Saurus CMS Community Edition 4.7.1 contains a vulnerability in the custom DB::prepare() function, which uses preg_replace() with the deprecated /e (eval) modifier to interpolate SQL query parameters. This leads to injection of user-controlled SQL statements, potentially leading to arbitrary PHP code execution.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
n/a · n/a

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://saurus.comhttp://saurused.comhttps://github.com/rahulhoysala/security-research/blob/main/CVE-2025-50567.mdhttps://in.linkedin.com/in/rahul-hoysala-221a26341