CVE-2021-47939: Evolution CMS 3.1.6 RCE Vulnerability

CVE-2021-47939 Overview

CVE-2021-47939 is an authenticated remote code execution vulnerability in Evolution CMS 3.1.6. The flaw allows authenticated users who hold module creation permissions to inject PHP code into module parameters and execute arbitrary system commands. Attackers send a crafted POST request to /manager/index.php containing malicious PHP in the post parameter, which is stored as a module body and executed when the module is invoked. The vulnerability is classified as Improper Control of Generation of Code [CWE-94] and carries a CVSS 4.0 base score of 8.7.

Critical Impact

An authenticated attacker with module-creation rights can achieve full server-side code execution on the web host, leading to data theft, lateral movement, and persistent backdoor installation.

Affected Products

• Evolution CMS version 3.1.6
• Evolution CMS administrative interface (/manager/index.php)
• Web hosts running PHP-based Evolution CMS module functionality

Discovery Timeline

• 2026-05-10 - CVE-2021-47939 published to NVD
• 2026-05-12 - Last updated in NVD database

Technical Details for CVE-2021-47939

Vulnerability Analysis

Evolution CMS exposes a module creation feature inside the administrative manager interface. The application accepts user-supplied content in the post parameter and stores it as the executable body of a CMS module. Because Evolution CMS treats module bodies as PHP source executed by the application runtime, any PHP payload submitted through this path is interpreted with the privileges of the web server process.

The vulnerability requires a valid authenticated session with module-creation permissions. Once a malicious module is saved, triggering the module from the manager interface executes the embedded PHP, including any system(), exec(), or passthru() calls placed in the payload. This produces a reliable, repeatable RCE primitive without memory corruption or complex exploitation techniques.

Root Cause

The root cause is the absence of input validation and code sanitization on module content. Evolution CMS does not restrict the PHP constructs permitted inside module definitions and does not sandbox module execution. This design treats privileged users as fully trusted and converts a content-management feature into a direct code-execution sink, matching the pattern described by CWE-94.

Attack Vector

The attack is network-based and post-authentication. An attacker obtains or compromises a manager account with module privileges, then issues an HTTP POST request to /manager/index.php containing the PHP payload in the post parameter and the appropriate action selector for module creation. After the module is persisted, the attacker invokes it through the manager interface or via a snippet reference, causing the server to execute the payload. Public proof-of-concept code for this technique is published as Exploit-DB #50296 and described in the VulnCheck advisory.

Detection Methods for CVE-2021-47939

Indicators of Compromise

• POST requests to /manager/index.php containing PHP tokens such as <?php, system(, passthru(, shell_exec(, or base64_decode( inside the post parameter.
• Newly created or recently modified module records in the Evolution CMS database authored by non-administrative accounts.
• Web server processes (php-fpm, apache2, www-data) spawning unexpected child processes such as sh, bash, curl, wget, nc, or python.
• Outbound network connections from the web host to attacker-controlled infrastructure shortly after module creation events.

Detection Strategies

• Inspect web access logs for POST traffic to /manager/index.php with abnormally large bodies or PHP code fragments in submitted parameters.
• Correlate manager authentication events with subsequent module creation actions to flag low-privilege users abusing module endpoints.
• Apply file integrity monitoring to the Evolution CMS installation directory and database tables that store module source.
• Use process lineage rules that alert when the PHP runtime spawns shell interpreters or network utilities.

Monitoring Recommendations

• Forward web server, PHP, and host process telemetry into a centralized SIEM and retain access logs for at least 90 days for retrospective hunting.
• Baseline normal module-management activity per administrator account and alert on deviations such as off-hours module creation or scripted access patterns.
• Monitor egress traffic from the web host and alert on connections to uncategorized or known-malicious domains following manager activity.

How to Mitigate CVE-2021-47939

Immediate Actions Required

• Upgrade Evolution CMS to a fixed release published after 3.1.6 by consulting the Evolution CMS releases page.
• Audit all manager accounts and revoke module-creation permissions from any user that does not strictly require them.
• Rotate credentials for all manager accounts and invalidate active sessions in case existing accounts have already been abused.
• Review the modules table and filesystem for unauthorized modules containing PHP execution primitives and remove any suspicious entries.

Patch Information

The vendor publishes security-corrected releases through the official Evolution CMS GitHub releases. Administrators running 3.1.6 should plan an upgrade to the latest stable release. Additional vendor information is available at the Evolution CMS project homepage.

Workarounds

• Restrict access to /manager/ at the web server or reverse-proxy layer using IP allow-lists or VPN-only access until patched.
• Enforce least privilege by removing the module-creation role from non-administrator accounts and require multi-factor authentication on all manager logins.
• Place a web application firewall in front of the manager interface and block requests whose parameters contain PHP opening tags or known dangerous functions.

# Configuration example: restrict /manager to trusted networks in nginx
location /manager/ {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    # Block obvious PHP payloads in POST bodies
    if ($request_method = POST) {
        set $block 0;
    }
    if ($http_content_type ~* "application/x-www-form-urlencoded") {
        set $block "${block}1";
    }
    # Forward sanitized traffic upstream
    proxy_pass http://evolution_backend;
}