Code Injection in CMS Made Simple - CVE-2019-9058
Published: October 8, 2019
Vulnerability identifier: #VU21606
CSH Severity: Medium
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-9058
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists in the administrator page "admin/changegroupperm.php" due to improper input validation in the "sel_groups" parameter. A remote authenticated administrator can send a specially crafted request and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
CMS Made Simple
How to mitigate CVE-2019-9058
Install updates from vendor's website.
CMS Made Simple - update to 2.2.10