Object Injection Vulnerability in CMS Made Simple by CMS Made Simple

CVE-2019-9055

Summary

An issue in CMS Made Simple version 2.2.8 enables a malicious user with Designer permission to exploit the DesignManager module via crafted parameters. This leads to an unserialize operation that can execute arbitrary objects, posing a significant security threat. The flaw resides in the action.admin_bulk_css.php and action.admin_bulk_template.php files, where improper validation allows an attacker to manipulate the m1_allparms parameter to achieve object injection, potentially compromising the integrity of the affected system.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

Metasploit exploit module for CVE-2019-9055
Created by Rapid7

References