Administrator code execution via executable module output

Code injection in REDAXO CMS 5.15.1 allows remote authenticated users with administrative access to execute arbitrary PHP code. The module editor in modules.modules.php stores administrator-supplied Output content as executable module PHP without neutralizing code syntax. An administrator must create the malicious module and attach it to an article; rendering that content runs commands in the web-server context and exposes readable data.