CVE-2014-8722

HIGH

GetSimple CMS 3.3.4 - Info Disclosure

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2014-8722. PoCs published by Ron Jost.

AI-analyzed exploit summary This exploit leverages an information disclosure vulnerability in GetSimple CMS 3.3.4 by directly accessing sensitive XML files (e.g., authorization.xml, user data) without authentication. It retrieves API keys, hashed passwords, and email addresses via HTTP requests.

Description

GetSimple CMS 3.3.4 allows remote attackers to obtain sensitive information via a direct request to (1) data/users/<username>.xml, (2) backups/users/<username>.xml.bak, (3) data/other/authorization.xml, or (4) data/other/appid.xml.

Exploits (1)

exploitdb WORKING POC
by Ron Jost · pythonwebappsphp
https://www.exploit-db.com/exploits/49928

This exploit leverages an information disclosure vulnerability in GetSimple CMS 3.3.4 by directly accessing sensitive XML files (e.g., authorization.xml, user data) without authentication. It retrieves API keys, hashed passwords, and email addresses via HTTP requests.

Classification
Working Poc 100%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: GetSimple CMS 3.3.4
No auth needed
Prerequisites: Network access to the target · Knowledge of the CMS path · Optional: Username for additional data retrieval
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Exploit, Third Party Advisory x_refsource_misc
http://rossmarks.uk/whitepapers/getSimple_cms_3.3.4.txt
Third Party Advisory x_refsource_misc
http://rossmarks.uk/portfolio.php

Scores

CVSS v3 7.5
EPSS 0.1437
EPSS Percentile 96.2%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-200
Status published
Products (1)
get-simple/getsimple_cms 3.3.4
Published Mar 17, 2017
Tracked Since Feb 18, 2026