Unauthenticated Path Traversal Vulnerability in CMS Made Simple
CVE-2019-9060

7.5HIGH

Key Information:

Vendor: Cmsmadesimple
Status: Cms Made Simple
Vendor: CVE Published:; 17 September 2021

🔔 Create Cmsmadesimple Vulnerability Alert

What is CVE-2019-9060?

An unauthenticated path traversal vulnerability exists in CMS Made Simple version 2.2.8, specifically within the CGExtensions module. This issue allows attackers to exploit the 'm1_filename' parameter in 'action.setdefaulttemplate.php' to access restricted file paths. Additionally, the vulnerability permits access to arbitrary file content through 'action.showmessage.php' by utilizing the traversal capabilities while manipulating 'm1_prefname' and setting 'm1_resettodefault' to 1. This flaw poses a significant risk as it enables unauthorized data exposure.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch