itodaro

14 exploits Active since Apr 2018
CVE-2018-10517 WRITEUP HIGH WRITEUP
CMS Made Simple < 2.2.7 - Authenticated Remote Code Execution via Module Import XML Package
In CMS Made Simple (CMSMS) through 2.2.7, the "module import" operation in the admin dashboard contains a remote code execution vulnerability, exploitable by an admin user, because an XML Package can contain base64-encoded PHP code in a data element.
CVSS 7.2
CVE-2018-10081 WRITEUP CRITICAL WRITEUP
CMS Made Simple < 2.2.7 - Admin Password Reset via Weak Hash Comparison
CMS Made Simple (CMSMS) through 2.2.6 contains an admin password reset vulnerability because data values are improperly compared, as demonstrated by a hash beginning with the "0e" substring.
CVSS 9.8
CVE-2018-10083 WRITEUP HIGH WRITEUP
CMS Made Simple < 2.2.7 - Arbitrary File Deletion via Directory Traversal in FilePicker Module
CMS Made Simple (CMSMS) through 2.2.7 contains an arbitrary file deletion vulnerability in the admin dashboard via directory traversal sequences in the val parameter within a cmd=del request, because code under modules\FilePicker does not restrict the val parameter.
CVSS 7.5
CVE-2018-10084 WRITEUP HIGH WRITEUP
CMSMS <2.2.6 - Privilege Escalation
CMS Made Simple (CMSMS) through 2.2.6 contains a privilege escalation vulnerability from ordinary user to admin user by arranging for the eff_uid value within $_COOKIE[$this->_loginkey] to equal 1, because an SHA-1 cryptographic protection mechanism can be bypassed.
CVSS 8.8
CVE-2018-10085 WRITEUP CRITICAL WRITEUP
CMS Made Simple < 2.2.6 - Remote Code Execution via Unserialize in LoginOperations
CMS Made Simple (CMSMS) through 2.2.6 allows PHP object injection because of an unserialize call in the _get_data function of \lib\classes\internal\class.LoginOperations.php. By sending a crafted cookie, a remote attacker can upload and execute code, or delete files.
CVSS 9.8
CVE-2018-10086 WRITEUP HIGH WRITEUP
CMS Made Simple < 2.2.7 - Authenticated Remote Code Execution via Test Function Eval Bypass
CMS Made Simple (CMSMS) through 2.2.7 contains an arbitrary code execution vulnerability in the admin dashboard because the implementation uses "eval('function testfunction'.rand()" and it is possible to bypass certain restrictions on these "testfunction" functions.
CVSS 7.2
CVE-2018-10515 WRITEUP HIGH WRITEUP
CMS Made Simple < 2.2.7 - Authenticated Remote Code Execution via File Unpack Operation
In CMS Made Simple (CMSMS) through 2.2.7, the "file unpack" operation in the admin dashboard contains a remote code execution vulnerability exploitable by an admin user because a .php file can be present in the extracted ZIP archive.
CVSS 7.2
CVE-2018-10516 WRITEUP MEDIUM WRITEUP
CMS Made Simple < 2.2.7 - Authenticated Sensitive Information Disclosure via File Rename Operation
In CMS Made Simple (CMSMS) through 2.2.7, the "file rename" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitable by an admin user, that can cause DoS by moving config.php to the upload/ directory.
CVSS 6.5
CVE-2018-10518 WRITEUP MEDIUM WRITEUP
CMS Made Simple < 2.2.7 - Authenticated Arbitrary File Deletion via Admin Dashboard
In CMS Made Simple (CMSMS) through 2.2.7, the "file delete" operation in the admin dashboard contains an arbitrary file deletion vulnerability that can cause DoS, exploitable by an admin user, because the attacker can remove all lib/ files in all directories.
CVSS 6.5
CVE-2018-10519 WRITEUP HIGH WRITEUP
CMS Made Simple 2.2.7 - Privilege Escalation via Cookie eff_uid Manipulation
CMS Made Simple (CMSMS) 2.2.7 contains a privilege escalation vulnerability from ordinary user to admin user by arranging for the eff_uid value within $_COOKIE[$this->_loginkey] to equal 1, because files in the tmp/ directory are accessible through HTTP requests. NOTE: this vulnerability exists because of an incorrect fix for CVE-2018-10084.
CVSS 8.8
CVE-2018-10520 WRITEUP MEDIUM WRITEUP
CMS Made Simple < 2.2.7 - Authenticated Arbitrary File Deletion via Module Remove Operation
In CMS Made Simple (CMSMS) through 2.2.7, the "module remove" operation in the admin dashboard contains an arbitrary file deletion vulnerability that can cause DoS, exploitable by an admin user, because the attacker can remove all lib/ files in all directories.
CVSS 6.5
CVE-2018-10521 WRITEUP LOW WRITEUP
CMS Made Simple < 2.2.7 - Authenticated Arbitrary File Movement via Admin Dashboard File Move Operation
In CMS Made Simple (CMSMS) through 2.2.7, the "file move" operation in the admin dashboard contains an arbitrary file movement vulnerability that can cause DoS, exploitable by an admin user, because config.php can be moved into an incorrect directory.
CVSS 2.7
CVE-2018-10522 WRITEUP MEDIUM WRITEUP
CMS Made Simple < 2.2.7 - Authenticated Sensitive Information Disclosure via File View Operation
In CMS Made Simple (CMSMS) through 2.2.7, the "file view" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitable by ordinary users, because the product exposes unrestricted access to the PHP file_get_contents function.
CVSS 4.9
CVE-2018-10523 WRITEUP MEDIUM WRITEUP
CMS Made Simple < 2.2.7 - Physical Path Leakage via DesignManager or FileManager Endpoints
CMS Made Simple (CMSMS) through 2.2.7 contains a physical path leakage Vulnerability via /modules/DesignManager/action.ajax_get_templates.php, /modules/DesignManager/action.ajax_get_stylesheets.php, /modules/FileManager/dunzip.php, or /modules/FileManager/untgz.php.
CVSS 5.3