What is CVE-2019-11231?

CVE-2019-11231 is a vulnerability in GetSimple CMS through 3.3.15 that allows an authenticated user to upload files with arbitrary content, including PHP code.

How severe is CVE-2019-11231?

CVE-2019-11231 has a severity rating of 9.8, which is considered critical.

How does CVE-2019-11231 affect GetSimple CMS?

CVE-2019-11231 affects GetSimple CMS versions up to and including 3.3.15.

Can an attacker bypass authentication to exploit CVE-2019-11231?

Yes, authentication can be bypassed to exploit CVE-2019-11231.

How can I mitigate the vulnerability in GetSimple CMS?

To mitigate the vulnerability, update GetSimple CMS to a version higher than 3.3.15 or apply the necessary patches provided by the vendor.

Vulnerability/
CVE-2019-11231

critical

9.8

CWE

22 352

22/5/2019

4/8/2024

CVE-2019-11231: Path Traversal

First published: Wed May 22 2019(Updated: )

An issue was discovered in GetSimple CMS through 3.3.15. insufficient input sanitation in the theme-edit.php file allows upload of files with arbitrary content (PHP code, for example). This vulnerability is triggered by an authenticated user; however, authentication can be bypassed. According to the official documentation for installation step 10, an admin is required to upload all the files, including the .htaccess files, and run a health check. However, what is overlooked is that the Apache HTTP Server by default no longer enables the AllowOverride directive, leading to data/users/admin.xml password exposure. The passwords are hashed but this can be bypassed by starting with the data/other/authorization.xml API key. This allows one to target the session state, since they decided to roll their own implementation. The cookie_name is crafted information that can be leaked from the frontend (site name and version). If a someone leaks the API key and the admin username, then they can bypass authentication. To do so, they need to supply a cookie based on an SHA-1 computation of this known information. The vulnerability exists in the admin/theme-edit.php file. This file checks for forms submissions via POST requests, and for the csrf nonce. If the nonce sent is correct, then the file provided by the user is uploaded. There is a path traversal allowing write access outside the jailed themes directory root. Exploiting the traversal is not necessary because the .htaccess file is ignored. A contributing factor is that there isn't another check on the extension before saving the file, with the assumption that the parameter content is safe. This allows the creation of web accessible and executable files with arbitrary content.

Credit: cve@mitre.org

Affected Software	Affected Version	How to fix
Get-simple Getsimple Cms	<=3.3.15

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is CVE-2019-11231?
CVE-2019-11231 is a vulnerability in GetSimple CMS through 3.3.15 that allows an authenticated user to upload files with arbitrary content, including PHP code.
How severe is CVE-2019-11231?
CVE-2019-11231 has a severity rating of 9.8, which is considered critical.
How does CVE-2019-11231 affect GetSimple CMS?
CVE-2019-11231 affects GetSimple CMS versions up to and including 3.3.15.
Can an attacker bypass authentication to exploit CVE-2019-11231?
Yes, authentication can be bypassed to exploit CVE-2019-11231.
How can I mitigate the vulnerability in GetSimple CMS?
To mitigate the vulnerability, update GetSimple CMS to a version higher than 3.3.15 or apply the necessary patches provided by the vendor.

collector/nvd-index
agent/references
agent/weakness
agent/type
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/severity
agent/author
agent/description
agent/tags
agent/softwarecombine
agent/first-publish-date
agent/event
vendor/get-simple
canonical/get-simple getsimple cms
version/get-simple getsimple cms/3.3.15