CVE-2017-16798: Improper Neutralization of Input During Web Page Generation

In CMS Made Simple 2.2.3.1, the isfileacceptable function in modules/FileManager/action.upload.php only blocks file extensions that begin or end with a "php" substring, which allows remote attackers to bypass intended access restrictions or trigger XSS via other extensions, as demonstrated by...

PT-2017-14568

Name of the Vulnerable Software and Affected Versions CMS Made Simple version 2.2.3.1 Description The issue allows remote attackers to bypass intended access restrictions or trigger XSS via certain file extensions. This is because the is file acceptable function in...