[KIS-2026-06] MetInfo CMS <= 8.1 (weixinreply.class.php) PHP Code Injection Vulnerability

Key Points:

• MetInfo CMS versions 7.9, 8.0, and 8.1 are vulnerable to a PHP code injection vulnerability (CVE-2026-29014) in the weixinreply.class.php file.
• This vulnerability allows remote, unauthenticated attackers to execute arbitrary PHP code, potentially leading to unauthorized access and control over affected systems.
• No official patch is currently available; users are advised to restrict access to the vulnerable application and monitor for any suspicious activity.

Technical Details: The vulnerability arises from improper sanitization of user input in the weixinreply::wxAdminLogin() method, allowing attackers to exploit path traversal sequences and inject malicious PHP code into cache files.

MITRE ATT&CK Techniques:

• T1203 - Exploit Public-Facing Application (Initial Access)
• T1059.001 - Command and Scripting Interpreter: PHP (Execution)

IOCs Mentioned:

• CVE-2026-29014