CVE-2019-9058: Improperly Controlled Modification of Object Prototype Attributes

An issue was discovered in CMS Made Simple 2.2.8. In the administrator page admin/changegroupperm.php, it is possible to send a crafted value in the selgroups parameter that leads to authenticated object injection...