CVE-2013-10051 is a critical (CVSS 9.8) remote PHP code execution flaw in InstantCMS 1.6 and earlier. The search view builds a PHP expression from the look parameter and runs it with eval(), so a crafted request runs attacker code. No fixed version is confirmed in the record.
What's affected
InstantCMS version 1.6 and earlier, per the record and VulnCheck. VulnCheck notes that the affected version range is undefined, so check older and forked copies too.
The record says user-supplied input in the look parameter is concatenated into a PHP expression and executed in the search view handler. It runs inside the context of the web server, so the attacker gets whatever that account can do.
I could not confirm a fixed release from the sources available. Check the InstantCMS project for a current version, and consider whether this site should still be running at all. Ask whoever hosts the site whether it is still in use and whether anyone owns it, since neglected sites are the likeliest to run old releases.
How to check if you're exposed
Find your InstantCMS version in the admin area or version file. Version 1.6 or earlier is in scope.
You can also search the code for the pattern behind the CVE. A call to eval that includes request data is the red flag:
grep -rn "eval(" /var/www/site --include=*.php | head -50
Review each hit that touches request input. In this CVE the code sits in the search view handler. Check web logs for odd search requests with long encoded values, and for unusual request headers.
What to do now
- Find every InstantCMS site and its version.
- Upgrade to a fixed release if the project offers one, or plan a migration off the product.
- Remove or disable the vulnerable search view code if you cannot upgrade immediately.
- Search the web root for unexpected PHP files and rebuild from a clean source if you find any.
- Rotate database credentials and any secrets the web application can read.
Why it matters
The weakness is CWE-95 (Eval Injection). The eval function turns a string into running code. When any part of that string comes from a visitor, the visitor writes part of the program. No input check short of removing eval makes this safe.
The fix pattern is to avoid eval entirely and handle the search request with ordinary logic, such as a parameterised query and fixed options. Static analysis tools flag eval calls with request data in them, which makes this an easy class to catch before release.
The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild, though public exploit material is referenced.
Try it yourself
A static scan flags dangerous calls like eval with request data long before release. This demo shows what that looks like.
Click through it at your own pace, or open it full screen.
Quick check
Why is eval so risky?
It runs a string as code. If a visitor controls any part of the string, they control part of what the server executes.
Which InstantCMS version fixes this?
I could not confirm one. The record lists 1.6 and earlier as affected. Check the project.
Sources
Last reviewed: 19 October 2026.
