Getsimplecms Ce
Monthly
Stored cross-site scripting in GetSimple CMS CE 3.3.22 and earlier allows an authenticated attacker to inject persistent JavaScript that executes in an administrator's browser session when the affected admin page renders. The flaw resides in the 'Theme to Components' feature (admin/components.php), where a component title is HTML-entity-decoded and then printed inside a double-quoted HTML attribute without re-encoding, enabling attribute breakout. Publicly available exploit code exists (SSVC exploitation: poc), and no vendor-released patch was identified at time of analysis; the independent assessment rates the issue as requiring low privileges (PR:L) and user interaction (UI:R), with scope change and low confidentiality/integrity impact.
Stored local file inclusion in GetSimple CMS CE 3.3.22 and earlier lets any authenticated account holding page-editing rights save an arbitrary filesystem path into a page's template attribute, which the public front-end then passes unsanitized to PHP include() whenever that page is requested - including by anonymous visitors. The payoff is disclosure of any readable local file and, if the included target contains PHP (a log, an uploaded file, or attacker-planted content), code execution in the web server's context. Publicly available exploit code exists and no vendor-released patch was identified at time of analysis; the main limiting factor is that the attacker must first possess a legitimate page-editing account, which keeps this a real but conditional risk rather than an unauthenticated emergency.
Stored cross-site scripting in GetSimple CMS CE 3.3.22 and earlier lets an authenticated user with page-editing rights plant JavaScript in a page's Keywords, Description, Menu text or Content, which then executes in the browser of any administrator who later opens that page's backup in the admin control panel (admin/backup-edit.php). Exploitation requires two combined conditions - a valid page-editing account and an administrator voluntarily viewing the affected backup - so it is not attacker-triggered, and the impact is confined to the admin control-panel browser context; no public exploit code has been identified at time of analysis and no vendor patch is currently available. The supplied CVSS 4.0 score of 8.8 appears inflated and inconsistent with the described prerequisites (our assessment is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, roughly 5.4), and there is no evidence of active exploitation.
Remote code execution in GetSimple CMS CE (Community Edition) prior to 1.5 stems from a cross-site request forgery flaw in the UpdateCE update form, which ships without an anti-CSRF token and whose POST handler performs no token or request-origin verification. A remote attacker, unauthenticated per the CVSS vector (PR:N), can host a page that auto-submits a forged POST to the update endpoint; when a logged-in administrator visits that page, the server performs an attacker-directed download-and-deploy of a malicious update package inside the administrator's session, and because the deployed content is executed (see the related ZIP-extraction advisory), the outcome is remote code execution. Exploitation is gated by the UI:R social-engineering precondition - an authenticated admin with an active session must be lured to the attacker's page - and no public exploit has been identified at time of analysis; the vendor fix is included in version 1.5.
Full-read server-side request forgery in GetSimple CMS CE versions prior to 1.5 allows an authenticated attacker with access to the update handler form to make the server fetch arbitrary URLs and read the response body back from a web-accessible file. The handler applies only FILTER_VALIDATE_URL format checking with no destination or scheme allowlisting, so requests can be aimed at internal-only services and cloud metadata endpoints such as 169.254.169.254, with the fetched body written to /Tmpfile.zip and left in place even when it is not a valid ZIP. Exploitation requires high privileges (CVSS PR:H) and the installed version must be below 1.5; publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV), and vendor-released patch 1.5 is available.
Remote code execution in GetSimple CMS CE prior to 1.5 allows an attacker to plant and execute PHP code as the web-server user by getting the UpdateCE.php handler to process a malicious ZIP archive. The handler extracts archive contents into the web-accessible root without validating file types or paths, so PHP webshells and ../ traversal writes are possible; publicly available exploit code exists, and SSVC rates it not automatable. Exploitation is high impact (CVSS 9.1) but constrained by the need to trigger the update through an administrator session or high existing privileges, so it is not mass-exploitable; version 1.5 contains the fix.
Administrator account takeover in GetSimple CMS CE 3.3.22 is achievable because the password reset endpoint is reachable without authentication and, on a reset request for an existing user, immediately writes a hash of a newly generated temporary password that was produced by PHP rand() seeded with microtime(). The time-bounded seed leaves a limited effective candidate space, and because the admin login endpoint enforces neither rate limiting nor account lockout (independent assessment: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), an unauthenticated remote attacker who knows or enumerates a valid username can generate candidate passwords and test them online until the correct one is found. Exploitation hinges on predicting or narrowing the PRNG value for the reset moment and sustaining enough login attempts, and it is self-defeating in stealth terms because submitting the reset silently overwrites the legitimate administrator's password; no public exploit code was identified at time of analysis and no vendor-released patch exists, though this is a genuine high-priority issue despite the absence of exploitation telemetry.
Unauthenticated administrator account creation affects GetSimple CMS (v3.4.0a and earlier) and its community edition GetSimpleCMS-CE (v3.3.22 and earlier), where a self-exclusion bug in the post-installation cleanup logic leaves admin/setup.php reachable on production sites. Any remote attacker can invoke the still-present setup script to register a new administrator, yielding full control of the CMS. No patched version exists at publication and no public exploit has been identified, though the flaw is trivially reproducible from the advisory description.
Stored cross-site scripting in GetSimple CMS CE 3.3.22 and earlier allows an authenticated attacker to inject persistent JavaScript that executes in an administrator's browser session when the affected admin page renders. The flaw resides in the 'Theme to Components' feature (admin/components.php), where a component title is HTML-entity-decoded and then printed inside a double-quoted HTML attribute without re-encoding, enabling attribute breakout. Publicly available exploit code exists (SSVC exploitation: poc), and no vendor-released patch was identified at time of analysis; the independent assessment rates the issue as requiring low privileges (PR:L) and user interaction (UI:R), with scope change and low confidentiality/integrity impact.
Stored local file inclusion in GetSimple CMS CE 3.3.22 and earlier lets any authenticated account holding page-editing rights save an arbitrary filesystem path into a page's template attribute, which the public front-end then passes unsanitized to PHP include() whenever that page is requested - including by anonymous visitors. The payoff is disclosure of any readable local file and, if the included target contains PHP (a log, an uploaded file, or attacker-planted content), code execution in the web server's context. Publicly available exploit code exists and no vendor-released patch was identified at time of analysis; the main limiting factor is that the attacker must first possess a legitimate page-editing account, which keeps this a real but conditional risk rather than an unauthenticated emergency.
Stored cross-site scripting in GetSimple CMS CE 3.3.22 and earlier lets an authenticated user with page-editing rights plant JavaScript in a page's Keywords, Description, Menu text or Content, which then executes in the browser of any administrator who later opens that page's backup in the admin control panel (admin/backup-edit.php). Exploitation requires two combined conditions - a valid page-editing account and an administrator voluntarily viewing the affected backup - so it is not attacker-triggered, and the impact is confined to the admin control-panel browser context; no public exploit code has been identified at time of analysis and no vendor patch is currently available. The supplied CVSS 4.0 score of 8.8 appears inflated and inconsistent with the described prerequisites (our assessment is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, roughly 5.4), and there is no evidence of active exploitation.
Remote code execution in GetSimple CMS CE (Community Edition) prior to 1.5 stems from a cross-site request forgery flaw in the UpdateCE update form, which ships without an anti-CSRF token and whose POST handler performs no token or request-origin verification. A remote attacker, unauthenticated per the CVSS vector (PR:N), can host a page that auto-submits a forged POST to the update endpoint; when a logged-in administrator visits that page, the server performs an attacker-directed download-and-deploy of a malicious update package inside the administrator's session, and because the deployed content is executed (see the related ZIP-extraction advisory), the outcome is remote code execution. Exploitation is gated by the UI:R social-engineering precondition - an authenticated admin with an active session must be lured to the attacker's page - and no public exploit has been identified at time of analysis; the vendor fix is included in version 1.5.
Full-read server-side request forgery in GetSimple CMS CE versions prior to 1.5 allows an authenticated attacker with access to the update handler form to make the server fetch arbitrary URLs and read the response body back from a web-accessible file. The handler applies only FILTER_VALIDATE_URL format checking with no destination or scheme allowlisting, so requests can be aimed at internal-only services and cloud metadata endpoints such as 169.254.169.254, with the fetched body written to /Tmpfile.zip and left in place even when it is not a valid ZIP. Exploitation requires high privileges (CVSS PR:H) and the installed version must be below 1.5; publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV), and vendor-released patch 1.5 is available.
Remote code execution in GetSimple CMS CE prior to 1.5 allows an attacker to plant and execute PHP code as the web-server user by getting the UpdateCE.php handler to process a malicious ZIP archive. The handler extracts archive contents into the web-accessible root without validating file types or paths, so PHP webshells and ../ traversal writes are possible; publicly available exploit code exists, and SSVC rates it not automatable. Exploitation is high impact (CVSS 9.1) but constrained by the need to trigger the update through an administrator session or high existing privileges, so it is not mass-exploitable; version 1.5 contains the fix.
Administrator account takeover in GetSimple CMS CE 3.3.22 is achievable because the password reset endpoint is reachable without authentication and, on a reset request for an existing user, immediately writes a hash of a newly generated temporary password that was produced by PHP rand() seeded with microtime(). The time-bounded seed leaves a limited effective candidate space, and because the admin login endpoint enforces neither rate limiting nor account lockout (independent assessment: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), an unauthenticated remote attacker who knows or enumerates a valid username can generate candidate passwords and test them online until the correct one is found. Exploitation hinges on predicting or narrowing the PRNG value for the reset moment and sustaining enough login attempts, and it is self-defeating in stealth terms because submitting the reset silently overwrites the legitimate administrator's password; no public exploit code was identified at time of analysis and no vendor-released patch exists, though this is a genuine high-priority issue despite the absence of exploitation telemetry.
Unauthenticated administrator account creation affects GetSimple CMS (v3.4.0a and earlier) and its community edition GetSimpleCMS-CE (v3.3.22 and earlier), where a self-exclusion bug in the post-installation cleanup logic leaves admin/setup.php reachable on production sites. Any remote attacker can invoke the still-present setup script to register a new administrator, yielding full control of the CMS. No patched version exists at publication and no public exploit has been identified, though the flaw is trivially reproducible from the advisory description.