CVE-2018-10086 Code injection in n/a
Attackers can execute arbitrary code in CMS Made Simple admin dashboard due to unsafe eval usage, requiring immediate upgrade.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-10086?
CVE-2018-10086 is a high-severity code injection vulnerability in Cmsmadesimple Cms Made Simple, published on 13 Apr 2018. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
CMS Made Simple (CMSMS) through 2.2.7 contains an arbitrary code execution vulnerability in the admin dashboard because the implementation uses "eval('function testfunction'.rand()" and it is possible to bypass certain restrictions on these "testfunction" functions.
Weakness: CWE-94
Which versions are affected by CVE-2018-10086?
It affects 1 product.
Products include Cmsmadesimple Cms Made Simple.
How do I fix CVE-2018-10086?
No fix has been published for CVE-2018-10086 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2018-10086 being exploited?
There is no known exploitation of CVE-2018-10086 in the wild and no public exploit code.
Other vulnerabilities in Cmsmadesimple Cms Made Simple
Sources
Also known as GHSA-hmxf-pqc3-jxh9.