CVE-2020-18184: 
Linux Ubuntu vulnerability analysis and mitigation

In PluXml version 5.7, a vulnerability was discovered in the theme edit function located at /PluXml/core/admin/parametres_edittpl.php. This security flaw was assigned CVE-2020-18184 and allows remote attackers to execute arbitrary PHP code by injecting malicious code into a template (NVD, GitHub Issue).

The vulnerability exists in the theme edit functionality of PluXml 5.7. According to the National Vulnerability Database, this issue has been assigned a CVSS v3.1 Base Score of 7.2 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The vulnerability allows attackers to execute arbitrary PHP code through template manipulation (NVD).

The successful exploitation of this vulnerability could lead to complete system compromise, as it allows attackers to execute arbitrary PHP code on the affected system. This could result in unauthorized access to sensitive data, system modification, and potential full system control (NVD).

The vulnerability can be exploited by sending a specially crafted POST request to /PluXml/core/admin/parametres_edittpl.php with malicious PHP code embedded in the template content. A proof of concept exploit has been publicly disclosed (GitHub Issue).