Remote Code Execution Vulnerability in CMSimple_XH by CMSimple
CVE-2021-42645

10CRITICAL

Key Information:

Vendor

Cmsimple-xh

Status
Cmsimple Xh
Vendor
CVE Published:
10 May 2022

What is CVE-2021-42645?

CMSimple_XH version 1.7.4 has a vulnerability that allows remote code execution, enabling an attacker to upload a malicious PHP payload via the 'File' parameter. Once successfully uploaded, the attacker can gain a reverse shell access to the affected host, compromising the integrity and security of the server. Users are strongly advised to upgrade to a patched version to mitigate the risks associated with this vulnerability.

References

https://github.com/Net-hunter121/CMSimple_XH-Unauth-RCE
x_refsource_MISC
https://github.com/cmsimple-xh/cmsimple-xh/releases/tag/1...
x_refsource_MISC

EPSS Score

6% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2021-42645 : Remote Code Execution Vulnerability in CMSimple_XH by CMSimple