Getsimple Cms
CVE-2024-55085
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
GetSimple CMS CE 3.3.19 suffers from arbitrary code execution in the template editing function in the background management system, which can be used by an attacker to implement RCE.
AnalysisAI
GetSimple CMS CE 3.3.19 suffers from arbitrary code execution in the template editing function in the background management system, which can be used by an attacker to implement RCE. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Code Injection (CWE-94), which allows attackers to inject and execute arbitrary code within the application. GetSimple CMS CE 3.3.19 suffers from arbitrary code execution in the template editing function in the background management system, which can be used by an attacker to implement RCE. Affected products include: Getsimple-Ce Getsimple Cms.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Never evaluate user-controlled input as code. Use sandboxing, disable dangerous functions, apply strict input validation.
More in Getsimple Cms
View allGetSimple CMS 3.3.4 allows remote attackers to obtain sensitive information via a direct request to (1) data/users/<user
An issue was discovered in GetSimple CMS through 3.3.15. Rated critical severity (CVSS 9.8), this vulnerability is remot
GetSimple CMS v3.3.16 was discovered to contain a remote code execution (RCE) vulnerability via the edited_file paramete
GetSimple CMS massiveAdmin plugin has a CSRF vulnerability enabling attackers to perform admin actions through crafted m
An issue was discovered in GetSimple CMS v3.3.13. Rated high severity (CVSS 8.8), this vulnerability is remotely exploit
Unauthenticated attackers can access sensitive files in GetSimple CMS when Apache's AllowOverride directive is disabled,
Arbitrary file read vulnerability in GetSimple CMS affects all versions through its Uploaded Files feature, allowing una
A Reflected Cross-Site Scripting (XSS) vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpa
There is XSS in GetSimple CMS 3.4.0.9 via the admin/edit.php title field. Rated medium severity (CVSS 6.1), this vulnera
Cross-site scripting (XSS) vulnerability in admin/template/js/uploadify/uploadify.swf in GetSimple CMS 3.3.13 allows rem
GetSimple CMS allows authenticated users to upload SVG files containing malicious JavaScript through the administrative
A vulnerability, which was classified as problematic, has been found in GetSimple CMS. Rated medium severity (CVSS 5.4),
Same weakness CWE-94 – Code Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today