CVE-2018-1000094 : CMS Made Simple version 2.2.5 contains a Remote Code Execution vulnerability in File Manager that can result in Allows a

CMS Made Simple version 2.2.5 contains a Remote Code Execution vulnerability in File Manager that can result in Allows an authenticated admin that has access to the file manager to execute code on the server. This attack appear to be exploitable via File upload -> copy to any extension.

Published 2018-03-13 01:29:01

Updated 2019-03-19 18:10:01

Source MITRE

View at NVD, CVE.org

Vulnerability category: Execute code

Exploit prediction scoring system (EPSS) score for CVE-2018-1000094

Probability of exploitation activity in the next 30 days: 82.43%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 98 % EPSS Score History EPSS FAQ

Metasploit modules for CVE-2018-1000094

CMS Made Simple Authenticated RCE via File Upload/Copy

Disclosure Date: 2018-07-03

First seen: 2020-04-26

exploit/multi/http/cmsms_upload_rename_rce

CMS Made Simple allows an authenticated administrator to upload a file and rename it to have a .php extension. The file can then be executed by opening the URL of the file in the /uploads/ directory. This module has been successfully tested on CMS Made Simple versio

More information

CVSS scores for CVE-2018-1000094

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.5	MEDIUM	AV:N/AC:L/Au:S/C:P/I:P/A:P	8.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
7.2	HIGH	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	1.2	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2018-1000094

CWE-434 Unrestricted Upload of File with Dangerous Type

The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-1000094

https://www.exploit-db.com/exploits/44976/

CMS Made Simple 2.2.5 - (Authenticated) Remote Code Execution
Exploit;Third Party Advisory;VDB Entry
http://dev.cmsmadesimple.org/bug/view/11741

CMS Made Simple - Forge : CMS Made Simple Core
Exploit;Issue Tracking;Vendor Advisory

Products affected by CVE-2018-1000094

Cmsmadesimple » Cms Made Simple » Version: 2.2.5
cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.5:*:*:*:*:*:*:*
Matching versions