PT-2025-31204 · Getsimple · Getsimple Cms

Published 2025-07-25 · Updated 2025-09-23 · CVE-2013-10032

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GetSimpleCMS version 3.2.1

Description An authenticated remote code execution issue exists in the application. The upload.php API endpoint allows authenticated users to upload arbitrary files without proper validation of MIME types or extensions. An attacker can bypass blacklist-based restrictions by uploading a .pht file containing PHP code, placing executable code within the web root. A crafted request using a polyglot or disguised extension allows the attacker to execute the payload by accessing the file directly via the web server. The issue is due to the use of a blacklist for filtering file types instead of a whitelist.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

RCE

Missing Authentication

Unrestricted File Upload

Weakness Enumeration

CWE-306

CWE-434

Related Identifiers

CVE-2013-10032

Affected Products

Getsimple Cms

References · 8

• 🔥 https://exploit-db.com/exploits/25405 · Exploit
• 🔥 https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/get_simple_cms_upload_exec.rb · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-10032 · Security Note
• https://fortiguard.com/encyclopedia/ips/39295 · Note
• https://broadcom.com/support/security-center/attacksignatures/detail?asid=27895 · Note
• https://t.me/cveNotify/136227 · Telegram Post
• https://get-simple.info · Note
• https://vulncheck.com/advisories/getsimple-cms-auth-rce-via-arbitrary-php-file-upload · Note