Vulnerability Description
In CMS Made Simple (CMSMS) through 2.2.7, the "module import" operation in the admin dashboard contains a remote code execution vulnerability, exploitable by an admin user, because an XML Package can contain base64-encoded PHP code in a data element.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cmsmadesimple | Cms Made Simple | <= 2.2.7 |
Related Weaknesses (CWE)
References
- https://github.com/itodaro/cmsms_cve/blob/master/README.mdExploitThird Party Advisory
- https://www.exploit-db.com/exploits/45793/ExploitThird Party AdvisoryVDB Entry
- https://github.com/itodaro/cmsms_cve/blob/master/README.mdExploitThird Party Advisory
- https://www.exploit-db.com/exploits/45793/ExploitThird Party AdvisoryVDB Entry
FAQ
What is CVE-2018-10517?
CVE-2018-10517 is a vulnerability with a CVSS score of 7.2 (HIGH). In CMS Made Simple (CMSMS) through 2.2.7, the "module import" operation in the admin dashboard contains a remote code execution vulnerability, exploitable by an admin user, because an XML Package can ...
How severe is CVE-2018-10517?
CVE-2018-10517 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-10517?
Check the references section above for vendor advisories and patch information. Affected products include: Cmsmadesimple Cms Made Simple.