CVE-2024-27622 Code injection in n/a
Authenticated administrators can execute arbitrary PHP code via unsanitized input in the User Defined Tags module of CMS Made Simple.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-27622?
CVE-2024-27622 is a high-severity code injection vulnerability in Cmsmadesimple Cms Made Simple, published on 5 Mar 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A remote code execution vulnerability has been identified in the User Defined Tags module of CMS Made Simple version 2.2.19 / 2.2.21. This vulnerability arises from inadequate sanitization of user-supplied input in the 'Code' section of the module. As a result, authenticated users with administrative privileges can inject and execute arbitrary PHP code.
Which versions are affected by CVE-2024-27622?
It affects 1 product.
Products include Cmsmadesimple Cms Made Simple.
How do I fix CVE-2024-27622?
No fix has been published for CVE-2024-27622 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-27622 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-27622 exists.
Other vulnerabilities in Cmsmadesimple Cms Made Simple
Sources
Also known as GHSA-fg3w-vv3r-vrgh.