Description (CNA)
CMSimple 5.4 contains an authenticated remote code execution vulnerability that allows logged-in attackers to inject malicious PHP code into template files. Attackers can exploit the template editing functionality by crafting a reverse shell payload and saving it through the template editing endpoint with a valid CSRF token.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Cmsimple / Cmsimple | affected 5.4 |
CWE
CWE-94
References
- https://www.exploit-db.com/exploits/50356
- https://www.cmsimple.org/
- https://www.vulncheck.com/advisories/cmsimple-authenticated-remote-code-execution-via-template-editing
ADP enrichment
No English description supplied.
No references supplied.