Description
setup/controllers/welcome.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the config_key parameter to the setup/index.php?action=welcome URI.
Remediation
References
Related Vulnerabilities
XWiki Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2023-46731)
Drupal Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2020-13674)
Plone CMS Server-Side Request Forgery (SSRF) Vulnerability (CVE-2021-33511)
JBoss Application Server Directory Traversal Vulnerability (CVE-2006-5750)
WordPress Plugin Welcart e-Commerce Multiple Vulnerabilities (1.4.17)