CVE-2018-10517: Code Injection
Published Apr 27, 2018
·Updated
In CMS Made Simple (CMSMS) through 2.2.7, the "module import" operation in the admin dashboard contains a remote code execution vulnerability, exploitable by an admin user, because an XML Package can contain base64-encoded PHP code in a data element.
Affected Software
1 affected component
CMSmadesimple CMS Made Simple<=2.2.7
Event History
Apr 27, 2018
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2018-10517?
CVE-2018-10517 is classified as a critical vulnerability due to its potential for remote code execution.
2
How do I fix CVE-2018-10517?
To fix CVE-2018-10517, upgrade CMS Made Simple to version 2.2.8 or later.
3
Who is affected by CVE-2018-10517?
CVE-2018-10517 affects all installations of CMS Made Simple version 2.2.7 and earlier.
4
What type of vulnerability is CVE-2018-10517?
CVE-2018-10517 is a remote code execution vulnerability found in the module import feature of CMS Made Simple.
5
Can an attacker exploit CVE-2018-10517 without admin access?
No, an attacker must have admin access to exploit CVE-2018-10517.