SB2019032615 - Multiple vulnerabilities in CMS Made Simple

Description

This security bulletin contains information about 8 secuirty vulnerabilities.

1) SQL injection (CVE-ID: CVE-2019-9053)

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data passed via the "m1_idlist" parameter. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

2) Deserialization of Untrusted Data (CVE-ID: CVE-2019-9055)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data in the "DesignManager" module in the "action.admin_bulk_css.php" and "action.admin_bulk_template.php" files. A remote authenticated attacker with Designer permission can reach an unserialize call with a crafted value in the "m1_allparms" parameter and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

3) Deserialization of Untrusted Data (CVE-ID: CVE-2019-9056)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data in the "FrontEndUsers" module in the "class.FrontEndUsersManipulate.php" or "class.FrontEndUsersManipulator.php" file. A remote authenticated attacker can pass specially crafted data with an untrusted "__FEU__" cookie to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

4) SQL injection (CVE-ID: CVE-2019-9693)

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists in the "class.showtime2_data.php" file due to insufficient sanitization of user-supplied data passed via the "_updateshow" (parameter show_id), "_inputshow" (parameter show_id), "_Getshowinfo" (parameter show_id), "_Getpictureinfo" (parameter picture_id), "_AdjustNameSeq" (parameter shownumber), "_Updatepicture" (parameter picture_id), and "_Deletepicture" (parameter picture_id) functions. A remote authenticated attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

5) Code Injection (CVE-ID: CVE-2019-9061)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in the "ModuleManager" module in the "action.installmodule.php" file. A remote authenticated attacker can send a specially crafted request and execute arbitrary code using the "install module" feature on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

6) Command Injection (CVE-ID: CVE-2019-9059)

7) Code Injection (CVE-ID: CVE-2019-9058)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists in the administrator page "admin/changegroupperm.php" due to improper input validation in the "sel_groups" parameter. A remote authenticated administrator can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

8) Code Injection (CVE-ID: CVE-2019-9057)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in the FilePicker module. A remote authenticated attacker can reach an unserialize call with an untrusted parameter and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Remediation

Install update from vendor's website.

References

• http://packetstormsecurity.com/files/152356/CMS-Made-Simple-SQL-Injection.html
• https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum
• http://viewsvn.cmsmadesimple.org/diff.php?repname=showtime2&path=%2Ftrunk%2Flib%2Fclass.showtime2_data.php&rev=47
• https://forum.cmsmadesimple.org/viewtopic.php?f=1&t=80285