CVE-2021-47860

This exploit chains CSRF to inject XSS into an admin's session, then uses XHR to achieve RCE by writing a PHP webshell. It requires an admin to visit a malicious site while authenticated.

This is a functional CSRF exploit targeting GetSimple CMS's Custom JS Plugin v0.1, demonstrating how an attacker can inject arbitrary JavaScript code into the CMS via a crafted POST request. The exploit leverages a lack of CSRF protection to achieve persistent XSS when an admin visits a malicious page.