high7.2Public exploit code
CVE-2017-8912
CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated administrators to execute arbitrary PHP code via the code parameter to admin/editusertag.php, related…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- CMS Made Simple 2.1.6 - Multiple Vulnerabilities2017-05-10 · webapps · php
Impact
CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated administrators to execute arbitrary PHP code via the code parameter to admin/editusertag.php, related to the CreateTagFunction and CallUserTag functions. NOTE: the vendor reportedly has stated this is "a feature, not a bug.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cmsmadesimple | Cms Made Simple | Version 2.1.6 |