CVE-2018-10517 Code injection in n/a
An admin user can execute arbitrary code via base64-encoded PHP in XML packages during module import in CMS Made Simple.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-10517?
CVE-2018-10517 is a high-severity code injection vulnerability in Cmsmadesimple Cms Made Simple, published on 27 Apr 2018. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
In CMS Made Simple (CMSMS) through 2.2.7, the "module import" operation in the admin dashboard contains a remote code execution vulnerability, exploitable by an admin user, because an XML Package can contain base64-encoded PHP code in a data element.
Weakness: CWE-94
Which versions are affected by CVE-2018-10517?
It affects 1 product.
Products include Cmsmadesimple Cms Made Simple.
How do I fix CVE-2018-10517?
No fix has been published for CVE-2018-10517 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2018-10517 being exploited?
There is no known exploitation of CVE-2018-10517 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry and 1 proofs of concept on GitHub.
Other vulnerabilities in Cmsmadesimple Cms Made Simple
Sources
Also known as GHSA-c585-x36v-3ppq.