CyberSec.Space Logo
Back to CVE Browser

CVE-2017-1000453

CRITICAL
9.8
CVSS Severity Score
EPSS Score0.1530%
EPSS Percentile13.33th
PublishedJan 2, 2018
Last ModifiedNov 21, 2024

Vulnerability Description

CMS Made Simple version 2.1.6 and 2.2 are vulnerable to Smarty templating injection in some core modules, resulting in unauthenticated PHP code execution.

Affected Platforms (CPE)

📦
Cmsmadesimple

Cms Made Simple

< 2.2
📦
Cmsmadesimple

Cms Made Simple

>= 2.2.1

References & Advisories

🔗 https://www.cmsmadesimple.org/2017/06/Announcing-CMSMS-2-2-1-Hearts-Desire/
🔗 https://www.cmsmadesimple.org/2017/06/Announcing-CMSMS-2-2-1-Hearts-Desire/

Related Vulnerabilities

CVE-2010-466310.0

Unspecified vulnerability in the News module in CMS Made Simple (CMSMS) before 1.9.1 has unknown impact and attack vectors.

CVE-2017-167839.8

In CMS Made Simple 2.1.6, there is Server-Side Template Injection via the cntnt01detailtemplate parameter.

CVE-2017-177359.8

CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in cookies.

CVE-2017-177349.8

CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in sessions.