CVE-2017-11404

CMS Made Simple (CMSMS) 2.2.2 is affected by a vulnerability where remote authenticated administrators can upload a .php file through a FileManager action to admin/moduleinterface.php. The issue is documented across multiple feeds (NVD and others) with an attack surface requiring authentication, ...

CMS Made Simple Upload Vulnerability (CNVD-2017-24997)

CMS Made Simple CMSMS is an open source content management system CMS developed by the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A security vulnerability exists in CMSMS version...

CVE-2017-11404

In CMS Made Simple CMSMS 2.2.2, remote authenticated administrators can upload a .php file via a FileManager action to admin/moduleinterface.php...

CVE-2017-11405

CMS Made Simple (CMSMS) 2.2.2 is affected by CVE-2017-11405. Remote authenticated administrators can abuse a sequence of actions (CMSContentManager to admin/moduleinterface.php, then a FilePicker action that changes type=image to type=file) to upload a PHP file. The exact vulnerability chain enab...

CMS Made Simple 2.2.1 Local File Inclusion

======= Details ======= Software:cmsmadesimple Homepage:http://www.cmsmadesimple.org/ version:=2.2.1 description:The File Inclusion vulnerability allows an attacker to include a file, usually exploiting a "dynamic file inclusion" mechanisms implemented in the target application. The vulnerability...

CMS Made Simple adminaddgroup.php file cross-site scripting vulnerability

CMS Made Simple is a free web-based content publishing system. A cross-site scripting vulnerability exists in the CMS Made Simple adminaddgroup.php file, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to gain access to sensiti...

Cross site scripting

In admin\addgroup.php in CMS Made Simple 2.1.6, when adding a user group, there is no XSS filtering, resulting in storage-type XSS generation, via the description parameter in an addgroup action...

CVE-2017-9668

In admin\addgroup.php in CMS Made Simple 2.1.6, when adding a user group, there is no XSS filtering, resulting in storage-type XSS generation, via the description parameter in an addgroup action...

CVE-2017-9668

In admin\addgroup.php in CMS Made Simple 2.1.6, when adding a user group, there is no XSS filtering, resulting in storage-type XSS generation, via the description parameter in an addgroup action...

CVE-2017-9668

In admin\addgroup.php in CMS Made Simple 2.1.6, when adding a user group, there is no XSS filtering, resulting in storage-type XSS generation, via the description parameter in an addgroup action...

CVE-2017-9668

CMS Made Simple

CMS Made Simple Arbitrary Code Execution Vulnerability

CMS Made Simple referred to as cmsms, it is an excellent lightweight open source content management system , using PHP, MySQL and Smarty template engine development . CMS Made Simple has an arbitrary code execution vulnerability. A remote attacker can exploit this vulnerability to execute arbitra...

CMS Made Simple Remote Code Execution Vulnerability

CMS Made Simple CMSMS is an open source content management system CMS developed by the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A remote code execution vulnerability exists in CM...

Design/Logic Flaw

DISPUTED CMS Made Simple CMSMS 2.1.6 allows remote authenticated administrators to execute arbitrary PHP code via the code parameter to admin/editusertag.php, related to the CreateTagFunction and CallUserTag functions. NOTE: the vendor reportedly has stated this is "a feature, not a bug."...

CVE-2017-8912

CMS Made Simple CMSMS 2.1.6 allows remote authenticated administrators to execute arbitrary PHP code via the code parameter to admin/editusertag.php, related to the CreateTagFunction and CallUserTag functions. NOTE: the vendor reportedly has stated this is "a feature, not a bug...

CVE-2017-8912

CMS Made Simple CMSMS 2.1.6 allows remote authenticated administrators to execute arbitrary PHP code via the code parameter to admin/editusertag.php, related to the CreateTagFunction and CallUserTag functions. NOTE: the vendor reportedly has stated this is "a feature, not a bug...

CVE-2017-8912

CMS Made Simple CMSMS 2.1.6 allows remote authenticated administrators to execute arbitrary PHP code via the code parameter to admin/editusertag.php, related to the CreateTagFunction and CallUserTag functions. NOTE: the vendor reportedly has stated this is "a feature, not a bug...

CVE-2017-8912

CVE-2017-8912 (CMS Made Simple 2.1.6) : A remote code execution vulnerability exists in admin/editusertag.php via the code parameter, enabling arbitrary PHP execution by remote authenticated admins. Root cause is tied to CreateTagFunction/CallUserTag logic. Affected software is CMS Made Simple 2....

CMS Made Simple 2.1.6 - Multiple Vulnerabilities

Exploit for php platform in category web applications Title: CMSMS 2.1.6 Multiple Vulnerabilities Date: 10-05-2017 Tested on: Windows 8 64-bit Exploit Author: Osanda Malith Jayathissa @OsandaMalith Original write-up: https://osandamalith.com/2017/05/11/cmsms-2-1-6-multiple-vulnerabilities/ CVE:...

CMS Made Simple 2.1.6 Code Execution / Cross Site Scripting

Title: CMSMS 2.1.6 Multiple Vulnerabilities Date: 10-05-2017 Tested on: Windows 8 64-bit Exploit Author: Osanda Malith Jayathissa @OsandaMalith Original write-up: https://osandamalith.com/2017/05/11/cmsms-2-1-6-multiple-vulnerabilities/ CVE: CVE-2017-8912 Remote Code Execution...