Privilege Escalation Vulnerability in CMS Made Simple by Simple CMS

CVE-2018-10084

Summary

CMS Made Simple (CMSMS) versions up to 2.2.6 have a vulnerability that allows an attacker to escalate privileges from an ordinary user to an admin user. This exploitation occurs when the eff_uid value in the $_COOKIE[$this->_loginkey] is modified to equal 1. This is made possible due to the bypassing of the SHA-1 cryptographic protection mechanism, presenting a significant security risk for affected systems.

References