Redeight CMS flaws enable auth bypass, RCE
Three critical vulnerabilities in Redeight CMS 1.0 allow SQL injection, arbitrary file upload for RCE, and password hash cracking via unsalted MD5.
CERT Polska coordinated the disclosure of three vulnerabilities affecting Redeight CMS version 1.0. CVE-2026-53690 is an unauthenticated SQL injection flaw in the admin login endpoint's userEmail parameter, allowing remote attackers to extract database contents. CVE-2026-53691 permits authenticated attackers to upload malicious PHP scripts via an unrestricted file upload vulnerability, leading to remote code execution when the files are accessed in the publicly-accessible uploads directory.
CVE-2026-53692 exposes a cryptographic weakness where the CMS stores passwords using unsalted MD5 hashes. Because MD5 is cryptographically broken and rainbow tables are readily available, attackers who obtain password hashes can trivially recover plaintext credentials. The vulnerabilities were responsibly reported by Jacek Czepil and disclosed through CERT Polska's coordinated vulnerability disclosure process.
Organisations running Redeight CMS 1.0 should immediately assess their exposure. The SQL injection vulnerability is particularly concerning as it requires no authentication, while the combination of weak password storage and file upload issues creates multiple paths to system compromise.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by Web Server Process (Possible Web Shell Execution)
Detects a web server process (e.g. php-cgi, php, apache, nginx, www-data context) spawning a command interpreter, indicative of a web shell dropped via an unrestricted file upload flaw such as CVE-2026-53691. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Spawning Command Shell (Possible Web Shell)
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \php-cgi.exe
- \php.exe
- \httpd.exe
- \nginx.exe
- \w3wp.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \bash.exe
- \sh.exe
condition: selection_parent and selection_child
fields:
- ParentImage
- Image
- CommandLine
- ParentCommandLine
falsepositives:
- Legitimate CMS/plugin admin scripts that intentionally invoke system utilities
- Server management scripts that call shells from a web application context
level: high
tags:
- attack.t1505.003
- attack.persistence
id: f8126522-0057-5537-bf47-1beeb7e5f2ef
status: experimental
author: Vorant
PHP File Written or Modified in Web Upload Directory
Detects creation or modification of a .php (or php-variant extension) file inside a web-accessible uploads directory, consistent with exploitation of an unrestricted file upload vulnerability like CVE-2026-53691 to drop a web shell. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PHP File Dropped in Uploads Directory
logsource:
category: file_event
product: linux
detection:
selection:
TargetFilename|contains: /uploads/
TargetFilename|endswith:
- .php
- .php3
- .php4
- .php5
- .phtml
- .pht
filter_legit:
Image|endswith:
- /composer
- /git
condition: selection and not filter_legit
falsepositives:
- Legitimate CMS updates or plugin installers writing PHP files to an uploads path
- Deployment tooling that stages application code through the same directory
level: high
tags:
- attack.t1505.003
- attack.t1190
id: 9acd0cee-3b1c-5821-b766-415b4e5b5dfc
status: experimental
author: Vorant
SQL Injection Pattern in Login Parameter (userEmail) via Web Request
Detects SQL injection meta-characters or keywords submitted in a login parameter (e.g. userEmail) of an authentication endpoint, consistent with unauthenticated SQL injection exploitation such as CVE-2026-53690. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SQL Injection Attempt in Login Parameter
logsource:
category: webserver
detection:
selection_field:
cs-uri-query|contains: userEmail
selection_sqli:
cs-uri-query|contains:
- ''''
- --
- UNION SELECT
- union select
- OR 1=1
- or 1=1
- SLEEP(
- sleep(
condition: selection_field and selection_sqli
falsepositives:
- Automated vulnerability scanners or authorized penetration testing against the login
endpoint
- Security research/QA fuzzing of the login form
level: high
tags:
- attack.t1190
id: e6b6f565-1ffc-562f-82f6-080a9b524cbc
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-53690/
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free