CVE-2025-50881: Remote Code Execution in API Use it Flow via moniteur.php

Identifier: CVE-2025-50881

Affected Product: API Use it Flow Version 8.2.0 (Rev 15851), Version 9.2.0 (Rev 18093)

Editor: https://www.tenorsolutions.com (formerly https://api-sas.fr/)

Affected Component(s): flow/admin/moniteur.php

Vulnerability Type: Remote Code Execution (RCE) via eval() Injection

Severity: Critical

Description: The flow/admin/moniteur.php script in is vulnerable to Remote Code Execution. When handling GET requests, the script takes user-supplied input from the action URL parameter, performs insufficient validation, and incorporates this input into a string ($wscom) that is subsequently executed by the eval() function. Although a method_exists() check is performed, it only validates the part of the user input before the first parenthesis (, allowing an attacker to append arbitrary PHP code after a valid method call structure. Successful exploitation allows an unauthenticated or trivially authenticated attacker to execute arbitrary PHP code on the server with the privileges of the web server process.

Vulnerable Code Snippets:

File: flow/admin/moniteur.php

1. Reading User Input (Line ~45):

   root@kitploit:~

   
           if (isset($_GET['action']))    {$action=urldecode(htmlentities($_GET['action']));}        else notice($server);
   

   Comment: $action is derived directly from user input ($_GET['action']) with only URL decoding and HTML entity encoding, which does not prevent code injection.

2. Constructing Command String (Line ~47):

   root@kitploit:~

   
           $wscom='$ws->'.$action;
   

   Comment: The user-controlled $action is concatenated into the $wscom string.

3. Insufficient Validation (Line ~49):

   root@kitploit:~

   
           $func=explode("(",$action);
           if (method_exists($ws, $func[0])) {
   

   Comment: Only the part of $action before the first parenthesis is checked against valid methods in the UIFWebService class.

4. Code Execution via eval() (Line ~50):

Exploitation: An attacker can craft a GET request to moniteur.php, providing arbitrary login and password parameters (as they are used for authentication within the called method, not for the eval itself) and a malicious action parameter. The action parameter must start with a valid method name from the UIFWebService class (e.g., get_data) to pass the method_exists check, followed by injected PHP code.

Example Payload :

GET /admin/moniteur.php?login=foo&password=bar&action=get_data(1);phpinfo();$res=0; HTTP/1.1
Host: <target>

This payload results in eval() executing code similar to: $res = $ws->get_data(1);phpinfo();$res=0;; This executes the get_data method, then executes phpinfo(), and finally sets $res to 0.

Impact: An attacker can execute arbitrary commands on the server, potentially leading to:

• Full system compromise.
• Data theft (database contents, sensitive files).
• Data modification or deletion.
• Installation of malware or backdoors.
• Using the compromised server to attack other systems.

Disclosure:

• 2025-04-22 : Editor is notified of vulnerabilities in Use It Flow product
• 2025-04-24 : Editor confirms vulnerabilities in v8 & v9, indicates version 10 will fix the problem but no release date is planned nor is it planned to inform customers about vulnerabilties.
• 2025-08-24 : Contacted editor for v10 release date. No reply.
• 2026-03-16 : Full disclosure of CVE-2025-50881