Description
MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature. An include order bug in modules/panel.class.php causes execution to continue past a redirect() call that lacks an exit statement, allowing unauthenticated requests to reach the ajax handler in inc_panel_ajax.php. The console handler within that file passes user-supplied input from GET parameters (via register_globals) directly to eval() without any authentication check. An attacker can execute arbitrary PHP code by sending a crafted GET request to /admin.php with ajax_panel, op, and command parameters.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| sergejey | MajorDoMo | — | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
MajorDoMo Console Eval Unauthenticated RCE
exploit/multi/http/majordomo_console_eval_rce
GitHub 1 repository
-
MaxMnMl/majordomo-CVE-2026-27174-poc ★ 0 · Feb 26, 2026
CVE-2026-27174 - An unauthenticated remote code execution via the admin panel's PHP console feature
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- MajorDoMo - Unauthenticated RCE http/cves/2026/CVE-2026-27174.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- MajorDoMo Revisited: What I Missed in 2023 third-party-advisory
- Fix PR: sergejey/majordomo#1177 issue-tracking patch
- VulnCheck Advisory: MajorDoMo Unauthenticated Remote Code Execution via Admin Console Eval third-party-advisory