CVE-2017-6070: Infoleak
CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to execute PHP code via the cntnt01fbrpformaformtemplate parameter in adminstoreform.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CMS Made Simple Form Builderto a version that resolves this vulnerability.Fixed in 0.8.1.6
Event History
Frequently Asked Questions
What is the severity of CVE-2017-6070?
CVE-2017-6070 has a high severity rating as it allows remote attackers to execute arbitrary PHP code.
How do I fix CVE-2017-6070?
To mitigate CVE-2017-6070, upgrade CMS Made Simple Form Builder to version 0.8.1.6 or later.
Which versions of CMS Made Simple are affected by CVE-2017-6070?
CVE-2017-6070 affects versions of CMS Made Simple Form Builder prior to 0.8.1.6 and CMS Made Simple versions up to 1.12.2.
Can exploiting CVE-2017-6070 lead to data breaches?
Yes, exploiting CVE-2017-6070 could allow an attacker to gain unauthorized access to sensitive data on the server.
What is the attack vector for CVE-2017-6070?
The attack vector for CVE-2017-6070 involves sending specially crafted requests to the admin_store_form endpoint.