PT-2017-17615 · Cmsms · Cms Made Simple

Published 2017-03-24 · Updated 2024-02-14 · CVE-2017-7256

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CMS Made Simple (CMSMS) version 2.1.6

Description A security issue exists in the "Content-->News-->Add Article" feature of the software, where an attacker can exploit the m1 summary parameter to conduct a cross-site scripting (XSS) attack. This attack requires the attacker to be logged in to the system.

Recommendations For CMS Made Simple (CMSMS) version 2.1.6, avoid using the m1 summary parameter in the "Content-->News-->Add Article" feature until a fix is available. As a temporary workaround, consider restricting access to this feature to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-7256

Affected Products

Cms Made Simple

References · 4

• 🔥 http://03i0.com/index.php/archives/113 · Exploit
• https://osv.dev/vulnerability/CVE-2017-7256 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7256 · Security Note
• http://securityfocus.com/bid/97204 · Note