CVE-2017-11405: Malicious File Upload
In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a CMSContentManager action to admin/moduleinterface.php, followed by a FilePicker action to admin/moduleinterface.php in which type=image is changed to type=file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-11405?
The severity of CVE-2017-11405 is classified as high due to its potential for remote code execution by authenticated users.
How do I fix CVE-2017-11405?
To fix CVE-2017-11405, upgrade CMS Made Simple to a version later than 2.2.2 that addresses this vulnerability.
Who is affected by CVE-2017-11405?
CVE-2017-11405 affects remote authenticated administrators using CMS Made Simple version 2.2.2.
What actions lead to the CVE-2017-11405 vulnerability exploitation?
The exploitation of CVE-2017-11405 involves uploading a .php file via the CMSContentManager action followed by modifying the FilePicker action.
What can attackers do with CVE-2017-11405?
Attackers can leverage CVE-2017-11405 to execute arbitrary PHP code on the server, potentially compromising the web application.