86 matches found
CVE-2018-10084
CMS Made Simple (CMSMS) vulnerability: CVE-2018-10084 affects CMSMS 2.2.7 (and earlier in some entries) where an ordinary user can escalate to admin by forcing eff_uid in $_COOKIE[$this->_loginkey] to 1. This occurs because files in the tmp/ directory become accessible via HTTP requests and an...
CVE-2018-10085
CMS Made Simple (CMSMS)
CVE-2018-10086
CMS Made Simple (CMSMS) up to version 2.2.7 has an arbitrary code execution vulnerability in the admin dashboard. The root cause is the use of eval('function testfunction'.rand()) which can bypass certain restrictions on these testfunction functions. Affected product: CMSMS. The issue is document...
CVE-2018-10086: Improper Control of Generation of Code
CMS Made Simple CMSMS through 2.2.7 contains an arbitrary code execution vulnerability in the admin dashboard because the implementation uses "eval'function testfunction'.rand" and it is possible to bypass certain restrictions on these "testfunction" functions...
CVE-2018-10085: Deserialization of Untrusted Data
CMS Made Simple CMSMS through 2.2.6 allows PHP object injection because of an unserialize call in the getdata function of \lib\classes\internal\class.LoginOperations.php. By sending a crafted cookie, a remote attacker can upload and execute code, or delete files...
CVE-2018-10082: Exposure of Sensitive Information to an Unauthorized Actor
CMS Made Simple CMSMS through 2.2.7 allows physical path leakage via an invalid /index.php?page= value, a crafted URI starting with /index.php?mact=Search, or a direct request to /admin/header.php, /admin/footer.php, /lib/tasks/class.ClearCache.task.php, or...
CVE-2018-10032
CMS Made Simple (CMSMS) 2.2.7 contains a Reflected XSS in admin/moduleinterface.php via the m1_version parameter. The issue is documented across multiple sources (NVD, Red Hat, CNVD, CVE lists) as a reflection vulnerability in CMSMS 2.2.7; details consistently indicate the vulnerable component is...
CVE-2018-10030
CMS Made Simple (CMSMS) 2.2.7 contains a CSRF vulnerability in admin/siteprefs.php. The connected records consistently describe a Cross-Site Request Forgery issue in that file/version, with no public exploitation details provided in these sources. The documents do not specify vulnerability vector...
CVE-2018-10029
CMS Made Simple (CMSMS) 2.2.7 is cited as having a Reflected XSS flaw in admin/moduleinterface.php via the m1_name parameter (linked to moduledepends). This CVE-2018-10029 description is explicitly differentiated from CVE-2017-16799. Across connected sources (CNVD, RH Red Hat, CNVD CNVD-2017-3650...
CVE-2018-10031
CVE-2018-10031 concerns CMS Made Simple (CMSMS) 2.2.7, where a Cross-Site Request Forgery (CSRF) flaw exists in admin/moduleinterface.php. Multiple connected sources corroborate that this is a CSRF vulnerability specific to CMSMS 2.2.7, with the CVE entry describing a CSRF in the admin interface....
CVE-2018-10033: Improper Neutralization of Input During Web Page Generation
CMS Made Simple aka CMSMS 2.2.7 has Stored XSS in admin/siteprefs.php via the metadata parameter...
CVE-2018-7893
CVE-2018-7893 : CMS Made Simple (CMSMS) 2.2.6 is affected by a stored XSS in admin/moduleinterface.php via the metadata parameter. The CVSS data (NVD) lists a base score of 3.5 (LOW) under CVSS2 and 4.8 (MEDIUM) under CVSS3, with network attack vector and low impact on confidentiality/availabilit...
CVE-2018-8058
CMS Made Simple (CMSMS) 2.2.6 contains a cross‑site scripting (XSS) vulnerability in admin/moduleinterface.php via the pagedata parameter. Affected component: CMSMS core web interface; vulnerability type: stored XSS. The CVE and related OpenVAS entry indicate multiple stored XSS vulnerabilities i...
CVE-2018-7893: Improper Neutralization of Input During Web Page Generation
CMS Made Simple CMSMS 2.2.6 has stored XSS in admin/moduleinterface.php via the metadata parameter...
CVE-2018-8058: Improper Neutralization of Input During Web Page Generation
CMS Made Simple CMSMS 2.2.6 has XSS in admin/moduleinterface.php via the pagedata parameter...
CVE-2018-7448: Improper Neutralization of Special Elements used in an OS Command
Remote code execution vulnerability in /cmsms-2.1.6-install.php/index.php in CMS Made Simple version 2.1.6 allows remote attackers to inject arbitrary PHP code via the "timezone" parameter in step 4 of a fresh installation procedure...
Design/Logic Flaw
CMS Made Simple CMSMS 2.2.5 has XSS in admin/moduleinterface.php via the m1messages parameter...
CVE-2018-5964
CMS Made Simple (CMSMS) 2.2.5 is reported to have a cross-site scripting (XSS) vulnerability in admin/moduleinterface.php via the m1_messages parameter. All connected sources describe the same issue, with the vulnerability affecting the processing of that parameter in the admin interface. The NVD...
CVE-2018-5965
CMS Made Simple (CMSMS) 2.2.5 exposes a Cross-Site Scripting (XSS) vulnerability in admin/moduleinterface.php via the m1_errors parameter. The root cause, as stated, is unvalidated input being reflected, enabling script injection in the context of the admin interface. Public references in the con...