CVE-2019-9055

An issue was discovered in CMS Made Simple 2.2.8. In the module DesignManager in the files action.adminbulkcss.php and action.adminbulktemplate.php, with an unprivileged user with Designer permission, it is possible reach an unserialize call with a crafted value in the m1allparms parameter, and...

CVE-2019-9055

CMS Made Simple 2.2.8 contains a vulnerability in the DesignManager module (action.admin_bulk_css.php and action.admin_bulk_template.php) where an unserialize call on m1_allparms can be triggered by an unprivileged user with Designer permission to achieve object injection, enabling authenticated ...

CVE-2019-9053

An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL injection via the m1idlist parameter...

CVE-2019-9053

CMS Made Simple 2.2.8 is affected by CVE-2019-9053 via the News module, allowing unauthenticated time-based blind SQL injection through the m1_idlist parameter. Public writeups and exploits in Connected documents indicate this vulnerability is exploitable to extract database information, and fixe...

PT-2019-19338

Name of the Vulnerable Software and Affected Versions CMS Made Simple versions 2.2.8 through 2.2.9 Description An issue was discovered that allows unauthenticated blind time-based SQL injection via the m1 idlist parameter in the News module. This can be achieved through a crafted URL. The issue i...

PT-2019-19344 · Cms Made Simple · Cms Made Simple

Name of the Vulnerable Software and Affected Versions: CMS Made Simple version 2.2.8 Description: An issue was discovered in the ModuleManager module, specifically in the action.installmodule.php file, where it is possible to reach an unserialize call with untrusted input. This can lead to...

PT-2019-19342 · Cms Made Simple · Cms Made Simple

Name of the Vulnerable Software and Affected Versions: CMS Made Simple version 2.2.8 Description: An issue was discovered in the administrator page "admin/changegroupperm.php" where it is possible to send a crafted value in the sel groups parameter, leading to authenticated object injection...

CVE-2019-9053

An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL injection via the m1idlist parameter. Recent assessments: Leafry at January 18, 2021 11:27pm UTC reported: This exploit is ok. When running...

PT-2019-11570

Name of the Vulnerable Software and Affected Versions: CMS Made Simple version 2.2.10 Description: The issue concerns a cross-site scripting XSS problem. It is located in the myaccount.php file, specifically in the "Email Address" field. This field is accessible through the "My Preferences - My...

PT-2019-19339

Name of the Vulnerable Software and Affected Versions CMS Made Simple version 2.2.8 Description An issue was discovered in the DesignManager module, specifically in the files action.admin bulk css.php and action.admin bulk template.php. With an unprivileged user having Designer permission, it is...

PT-2019-11568

Name of the Vulnerable Software and Affected Versions: CMS Made Simple version 2.2.10 Description: The issue concerns a Self-XSS vulnerability that can be triggered via the Layout Design Manager, specifically through the "Name" field. This field is accessible when creating a new template action i...

PT-2019-19341 · Cms Made Simple · Cms Made Simple

Name of the Vulnerable Software and Affected Versions: CMS Made Simple version 2.2.8 Description: An issue was discovered in the FilePicker module, where it is possible to reach an unserialize call with an untrusted parameter, achieving authenticated object injection. Recommendations: For CMS Mad...

CVE-2019-9057: Deserialization of Untrusted Data

An issue was discovered in CMS Made Simple 2.2.8. In the module FilePicker, it is possible to reach an unserialize call with an untrusted parameter, and achieve authenticated object injection...

CVE-2019-9058: Improperly Controlled Modification of Object Prototype Attributes

An issue was discovered in CMS Made Simple 2.2.8. In the administrator page admin/changegroupperm.php, it is possible to send a crafted value in the selgroups parameter that leads to authenticated object injection...

PT-2019-19343

Name of the Vulnerable Software and Affected Versions CMS Made Simple version 2.2.8 Description An issue allows command injection with an administrator account by modifying the path of the e-mail executable in Mail Settings. This is achieved by setting "sendmail" in the "Mailer" option and...

PT-2019-11569

Name of the Vulnerable Software and Affected Versions: CMS Made Simple version 2.2.10 Description: The issue concerns an XSS vulnerability that can be triggered via the 'moduleinterface.php' Name field. This field is accessible through an "Add Category" action in the "Site Admin Settings - News...

CVE-2019-9059: Improper Neutralization of Special Elements used in a Command

An issue was discovered in CMS Made Simple 2.2.8. It is possible, with an administrator account, to achieve command injection by modifying the path of the e-mail executable in Mail Settings, setting "sendmail" in the "Mailer" option, and launching the "Forgot your password" feature...

CVE-2019-9053: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL injection via the m1idlist parameter...

CVE-2019-9055: Deserialization of Untrusted Data

An issue was discovered in CMS Made Simple 2.2.8. In the module DesignManager in the files action.adminbulkcss.php and action.adminbulktemplate.php, with an unprivileged user with Designer permission, it is possible reach an unserialize call with a crafted value in the m1allparms parameter, and...

CVE-2019-9061: Deserialization of Untrusted Data

An issue was discovered in CMS Made Simple 2.2.8. In the module ModuleManager in the file action.installmodule.php, it is possible to reach an unserialize call with untrusted input and achieve authenticated object injection by using the "install module" feature...