CVE-2018-10523

CVE-2018-10523 : CMS Made Simple (CMSMS)

CVE-2018-10516

CVE-2018-10516 affects CMS Made Simple (CMSMS) up to version 2.2.7. The vulnerability lies in the admin dashboard “file rename” operation, which can disclose sensitive information and cause a Denial of Service by moving the config.php file into the upload/ directory. The issue is exploitable by a...

CVE-2018-10522

CMS Made Simple (CMSMS) up to version 2.2.7 contains an information-disclosure vulnerability in the admin dashboard’s file view operation. The issue arises because the PHP file_get_contents function is exposed without access restrictions, allowing ordinary users to read arbitrary files. The cited...

CVE-2018-10521

In CMS Made Simple CMSMS through 2.2.7, the "file move" operation in the admin dashboard contains an arbitrary file movement vulnerability that can cause DoS, exploitable by an admin user, because config.php can be moved into an incorrect directory...

CVE-2018-10517

In CMS Made Simple CMSMS through 2.2.7, the "module import" operation in the admin dashboard contains a remote code execution vulnerability, exploitable by an admin user, because an XML Package can contain base64-encoded PHP code in a data element...

CVE-2018-10523

CMS Made Simple CMSMS through 2.2.7 contains a physical path leakage Vulnerability via /modules/DesignManager/action.ajaxgettemplates.php, /modules/DesignManager/action.ajaxgetstylesheets.php, /modules/FileManager/dunzip.php, or /modules/FileManager/untgz.php...

CVE-2018-10515

In CMS Made Simple CMSMS through 2.2.7, the "file unpack" operation in the admin dashboard contains a remote code execution vulnerability exploitable by an admin user because a .php file can be present in the extracted ZIP archive...

CVE-2018-10520

CMS Made Simple (CMSMS) up to version 2.2.7 contains an arbitrary file deletion vulnerability in the admin dashboard’s module remove operation. The issue allows an admin user to delete files under the lib/ directories across all paths, leading to denial of service (DoS). The description from Red ...

CVE-2018-10522

In CMS Made Simple CMSMS through 2.2.7, the "file view" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitable by ordinary users, because the product exposes unrestricted access to the PHP filegetcontents function...

CVE-2018-10515

CMS Made Simple (CMSMS) up to version 2.2.7 is affected by a remote code execution vulnerability in the admin dashboard’s file unpack operation. The underlying issue is that the extracted ZIP archive may contain a .php file, which an admin user can trigger to execute code on the server. If unpatc...

CVE-2018-10518

CMS Made Simple (CMSMS)

Code Execution Vulnerability in cms made simple Backend Package Release

CMS Made Simple is an open source content management system. It is built using PHP and Smarty Engine , which separates content , functionality and templates . cms made simple version 2.2.7 code execution vulnerability exists in the background when decompressing the uploaded zip package , due to t...

Code execution vulnerability in cms made simple backend file copying

CMS Made Simple is an open source content management system. It is built using PHP and Smarty Engine , which separates content , functionality and templates . A code execution vulnerability exists in cms made simple version 2.2.7 when performing file copying in the background, which can be...

Authentication Flaw Vulnerability in CMS Made Simple Version 2.2.7

CMS Made Simple is an open source content management system. It is built using PHP and Smarty Engine , which separates content , functionality and templates . CMS Made Simple version 2.2.7 suffers from an authentication flaw vulnerability, which can be exploited by an attacker to elevate an...

CMS Made Simple Directory Traversal Vulnerability

CMS Made Simple CMSMS is an open source content management system CMS developed by the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A directory traversal vulnerability exists in CMSM...

CVE-2018-9921

In CMS Made Simple 2.2.7, a Directory Traversal issue makes it possible to determine the existence of files and directories outside the web-site installation directory, and determine whether a file has contents matching a specified checksum. The attack uses an admin/checksum.php?c= request...

Directory traversal

In CMS Made Simple 2.2.7, a Directory Traversal issue makes it possible to determine the existence of files and directories outside the web-site installation directory, and determine whether a file has contents matching a specified checksum. The attack uses an admin/checksum.php?c= request...

CVE-2018-9921

In CMS Made Simple 2.2.7, a Directory Traversal issue makes it possible to determine the existence of files and directories outside the web-site installation directory, and determine whether a file has contents matching a specified checksum. The attack uses an admin/checksum.php?c= request...

CVE-2018-9921

CVE-2018-9921 affects CMS Made Simple 2.2.7. The vulnerability is a directory traversal allowing an attacker to determine the existence of files/directories outside the installation and whether a file’s contents match a given checksum via an admin/checksum.php?__c= request. This is a information-...

CVE-2018-1000158

cmsmadesimple version 2.2.7 contains a Incorrect Access Control vulnerability in the function of sendrecoveryemail in the line "$url = $config'adminurl' . '/login.php?recoverme=' . $code;" that can result in Administrator Password Reset Poisoning, specifically a reset URL pointing at an attacker...