PT-2018-14954 · Getsimple · Getsimple Cms

Hexifeo · Published 2018-11-21 · Updated 2018-12-28 · CVE-2018-19420

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions GetSimpleCMS version 3.3.15

Description The issue allows HTML execution through alternative file uploads. This can occur with files having no extension or unrecognized extensions, such as 'test' or 'test.asdf', due to vulnerabilities in admin/upload-uploadify.php and the validate safe file function in admin/inc/security functions.php.

Recommendations For GetSimpleCMS version 3.3.15, consider restricting or validating file uploads more strictly to prevent HTML execution, and review the validate safe file function in admin/inc/security functions.php to ensure it correctly handles files with no or unrecognized extensions.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2018-19420

Affected Products

Getsimple Cms

References · 4

• 🔥 https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1301 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-19420 · Security Note
• https://osv.dev/vulnerability/CVE-2018-19420 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19420 · Note