PT-2023-12130 · Unknown · Cms Made Simple

Riccardo Krauter · Publicado 2023-05-08 · Atualizado 2025-01-29 · CVE-2021-28998

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CMS Made Simple versions through 2.2.15

Description The issue allows remote authenticated attackers to gain a webshell via a crafted phar file. This is achieved through a file upload vulnerability.

Recommendations For versions through 2.2.15, update to a version later than 2.2.15 to resolve the issue. As a temporary workaround, consider restricting file uploads to minimize the risk of exploitation.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2021-28998

Produtos afetados

Cms Made Simple

Referências · 6

• 🔥 https://github.com/beerpwn/CVE/blob/master/cms_made_simple_2021/file_upload_RCE/File_upload_to_RCE.md · Exploit
• https://t.me/cvenotify/108974 · Publicação no Telegram
• https://t.me/cvenotify/49941 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2021-28998 · Nota de Segurança
• https://seclists.org/fulldisclosure/2021/Mar/50 · Nota
• https://osv.dev/vulnerability/CVE-2021-28998 · Aviso do Fabricante