CVE-2021-47778
HIGHGetSimple CMS My SMTP Contact Plugin <1.1.2 - Code Injection
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2021-47778. PoCs published by boku.
AI-analyzed exploit summary This exploit chains a CSRF vulnerability with PHP code injection in GetSimple CMS's My SMTP Contact plugin to achieve remote code execution. The PoC sets up a malicious server to deliver a CSRF payload that injects PHP code into the plugin's configuration, leading to RCE when an admin visits the site.
Description
GetSimple CMS My SMTP Contact Plugin 1.1.2 contains a PHP code injection vulnerability. An authenticated administrator can inject arbitrary PHP code through plugin configuration parameters, leading to remote code execution on the server.
Exploits (1)
This exploit chains a CSRF vulnerability with PHP code injection in GetSimple CMS's My SMTP Contact plugin to achieve remote code execution. The PoC sets up a malicious server to deliver a CSRF payload that injects PHP code into the plugin's configuration, leading to RCE when an admin visits the site.
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H