CVE-2017-8912

2017-05-1206:54:00

mitre

github.com

AI Score

7.8

Confidence

Low

SSVC

Exploitation

poc

Automatable

Technical Impact

total

JSON

CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated administrators to execute arbitrary PHP code via the code parameter to admin/editusertag.php, related to the CreateTagFunction and CallUserTag functions. NOTE: the vendor reportedly has stated this is "a feature, not a bug.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.1.6:*:*:*:*:*:*:*"
    ],
    "vendor": "cmsmadesimple",
    "product": "cms_made_simple",
    "versions": [
      {
        "status": "affected",
        "version": "2.1.6"
      }
    ],
    "defaultStatus": "unknown"
  }
]