Remote code execution in CMS Made Simple - CVE-2018-7448

Vulnerability identifier: #VU10794

CSH Severity: High

CVSS v4: 9.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]

CVE-ID: CVE-2018-7448

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote authenticated attacker to execute arbitrary PHP code on the target system.

The weakness exists in the config.php file due to insufficient validation of user-supplied input. A remote attacker can send a specially crafted input, inject arbitrary PHP code via the timezone parameter in the config.php file and execute arbitrary PHP code.

Successful exploitation of the vulnerability may result in system compromise.

CMS Made Simple

Update to version 2.2 or later.

• Exploit #9739 - exploit-cve-2018-7448 (Python script for CMS Made Simple 2.1.6 - Remote Code Execution.) (April 19, 2024)
• Exploit #6255 - CMS Made Simple 2.1.6 - Remote Code Execution (June 17, 2021)

• http://dev.cmsmadesimple.org/project/changelog/5471

• Remote code execution in CMS Made Simple