PT-2024-25246 · Cmsimple · Cmsimple

Antonio Díaz · Published 2024-05-01 · Updated 2024-07-03 · CVE-2024-33423

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions CMSimple version 5.15

Description A Cross-Site Scripting (XSS) issue in the Settings menu of CMSimple allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Logout parameter under the Language section. This enables attackers to potentially hijack user sessions, steal sensitive data, or perform other malicious actions.

Recommendations For CMSimple version 5.15, update to a newer version that contains a fix for this issue. As a temporary workaround, consider restricting access to the Settings menu, especially the Language section, to minimize the risk of exploitation. Avoid using the Logout parameter in the affected section until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

Related Identifiers

CVE-2024-33423

Affected Products

Cmsimple

References · 6

• 🔥 https://github.com/adiapera/xss_language_cmsimple_5.15 · Exploit
• https://osv.dev/vulnerability/CVE-2024-33423 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-33423 · Security Note
• https://twitter.com/CVEnew/status/1785779838999261251 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1785803680832209257 · Twitter Post
• https://t.me/cvenotify/78821 · Telegram Post