ID:6186 - Exploit for Command injection in CMS Made Simple - CVE-2018-1000094

Link to public exploit:

Vulnerability description

The vulnerability allows a remote administrative attacker to execute arbitrary commands on the target system.

The vulnerability exists in the File Manager interface of CMS Made Simple due to insufficient validation of user-supplied input. A remote attacker can upload a malicious file, inject arbitrary commands and execute arbitrary code with elevated privileges.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Remediation