Command Injection Vulnerability in IdeaCMS Versions Up to 1.8
CVE-2025-11331

5.1MEDIUM

Key Information:

Vendor

IdeaCMS

Status
Ideacms
Vendor
CVE Published:
6 October 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-11331?

A command injection vulnerability exists in IdeaCMS in versions up to 1.8, specifically within an unidentified function in the app/common/logic/admin/Config.php file related to the Website Name Handler. This flaw allows an attacker to manipulate the argument '网站名称' to execute arbitrary commands on the server. Given that the exploit is publicly available, the potential for remote attacks poses a significant threat. Although the vendor was previously notified about this vulnerability, there has been no response or patch released.

Affected Version(s)

IdeaCMS 1.0

IdeaCMS 1.1

IdeaCMS 1.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-11331 - Proof of Concept

References

https://vuldb.com/?id.327214
vdb-entrytechnical-description
https://vuldb.com/?ctiid.327214
signaturepermissions-required
https://vuldb.com/?submit.664550
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

tiancesec (VulDB User)
JSON
.
CVE-2025-11331 : Command Injection Vulnerability in IdeaCMS Versions Up to 1.8