CVE-2021-47735
HIGHCMSimple 5.4 - Authenticated Remote Code Execution via Template Editing
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2021-47735. PoCs published by pussycat0x.
AI-analyzed exploit summary This exploit targets Cmsimple 5.4, leveraging authenticated RCE by injecting a PHP reverse shell into the template file via CSRF-protected form submission. It requires valid credentials and a listener setup.
Description
CMSimple 5.4 contains an authenticated remote code execution vulnerability that allows logged-in attackers to inject malicious PHP code into template files. Attackers can exploit the template editing functionality by crafting a reverse shell payload and saving it through the template editing endpoint with a valid CSRF token.
Exploits (1)
This exploit targets Cmsimple 5.4, leveraging authenticated RCE by injecting a PHP reverse shell into the template file via CSRF-protected form submission. It requires valid credentials and a listener setup.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H