Vulnerability Description
GetSimple CMS My SMTP Contact Plugin 1.1.2 contains a PHP code injection vulnerability. An authenticated administrator can inject arbitrary PHP code through plugin configuration parameters, leading to remote code execution on the server.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Get-Simple | Getsimplecms | 1.1.2 |
Related Weaknesses (CWE)
References
- http://get-simple.infoProduct
- https://github.com/GetSimpleCMS/GetSimpleCMSProduct
- https://github.com/boku7/gsSMTP-Csrf2Xss2RCE/ExploitThird Party Advisory
- https://www.exploit-db.com/exploits/49774ExploitThird Party AdvisoryVDB Entry
- https://www.vulncheck.com/advisories/getsimple-cms-my-smtp-contact-plugin-php-coThird Party Advisory
FAQ
What is CVE-2021-47778?
CVE-2021-47778 is a vulnerability with a CVSS score of 7.2 (HIGH). GetSimple CMS My SMTP Contact Plugin 1.1.2 contains a PHP code injection vulnerability. An authenticated administrator can inject arbitrary PHP code through plugin configuration parameters, leading to...
How severe is CVE-2021-47778?
CVE-2021-47778 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-47778?
Check the references section above for vendor advisories and patch information. Affected products include: Get-Simple Getsimplecms.