Privilege Escalation Vulnerability in CMS Made Simple by CMS Made Simple, Inc.

CVE-2018-10519

Summary

CMS Made Simple version 2.2.7 is susceptible to a privilege escalation vulnerability, allowing an ordinary user to gain administrative access. This issue arises from the manipulation of the eff_uid value within the cookie, which can be exploited due to the accessibility of files in the tmp/ directory via HTTP requests. The vulnerability is also linked to a previous inadequate fix for another vulnerability, emphasizing the need for comprehensive security assessments and updates to mitigate risks.

References