CMS Made Simple 1.0.1

CPE Details

CMS Made Simple 1.0.1
cmsmadesimple
cms_made_simple
1.0.1
2010-05-13
11h16 +00:00
2011-06-30
13h00 +00:00
CPE NVD
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
Gestion des notifications

CPE Name: cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.1:*:*:*:*:*:*:*

Informations

Vendor

cmsmadesimple

Product

cms_made_simple

Version

1.0.1

Related CVE

Open and find in CVE List

CVE ID Publié Description Score Gravité
CVE-2021-28998 2023-05-08 00h00 +00:00 File upload vulnerability in CMS Made Simple through 2.2.15 allows remote authenticated attackers to gain a webshell via a crafted phar file.
7.2
Haute
CVE-2021-28999 2023-05-08 00h00 +00:00 SQL Injection vulnerability in CMS Made Simple through 2.2.15 allows remote attackers to execute arbitrary commands via the m1_sortby parameter to modules/News/function.admin_articlestab.php.
8.8
Haute
CVE-2021-40961 2022-06-08 22h00 +00:00 CMS Made Simple <=2.2.15 is affected by SQL injection in modules/News/function.admin_articlestab.php. The $sortby variable is concatenated with $query1, but it is possible to inject arbitrary SQL language without using the '.
8.8
Haute
CVE-2020-22842 2020-09-30 01h12 +00:00 CMS Made Simple before 2.2.15 allows XSS via the m1_mod parameter in a ModuleManager local_uninstall action to admin/moduleinterface.php.
5.4
Moyen
CVE-2020-13660 2020-05-28 16h53 +00:00 CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name.
4.8
Moyen
CVE-2011-4310 2019-11-26 21h57 +00:00 The news module in CMSMS before 1.9.4.3 allows remote attackers to corrupt new articles.
7.5
Haute
CVE-2019-11513 2019-04-25 00h52 +00:00 The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the "New name" field in a Rename action.
4.8
Moyen
CVE-2019-9061 2019-03-26 15h49 +00:00 An issue was discovered in CMS Made Simple 2.2.8. In the module ModuleManager (in the file action.installmodule.php), it is possible to reach an unserialize call with untrusted input and achieve authenticated object injection by using the "install module" feature.
8.8
Haute
CVE-2019-9059 2019-03-26 15h45 +00:00 An issue was discovered in CMS Made Simple 2.2.8. It is possible, with an administrator account, to achieve command injection by modifying the path of the e-mail executable in Mail Settings, setting "sendmail" in the "Mailer" option, and launching the "Forgot your password" feature.
7.2
Haute
CVE-2019-9058 2019-03-26 15h40 +00:00 An issue was discovered in CMS Made Simple 2.2.8. In the administrator page admin/changegroupperm.php, it is possible to send a crafted value in the sel_groups parameter that leads to authenticated object injection.
7.2
Haute
CVE-2019-9057 2019-03-26 15h34 +00:00 An issue was discovered in CMS Made Simple 2.2.8. In the module FilePicker, it is possible to reach an unserialize call with an untrusted parameter, and achieve authenticated object injection.
8.8
Haute
CVE-2019-9055 2019-03-26 15h25 +00:00 An issue was discovered in CMS Made Simple 2.2.8. In the module DesignManager (in the files action.admin_bulk_css.php and action.admin_bulk_template.php), with an unprivileged user with Designer permission, it is possible reach an unserialize call with a crafted value in the m1_allparms parameter, and achieve object injection.
8.8
Haute
CVE-2019-9693 2019-03-11 18h00 +00:00 In CMS Made Simple (CMSMS) before 2.2.10, an authenticated user can achieve SQL Injection in class.showtime2_data.php via the functions _updateshow (parameter show_id), _inputshow (parameter show_id), _Getshowinfo (parameter show_id), _Getpictureinfo (parameter picture_id), _AdjustNameSeq (parameter shownumber), _Updatepicture (parameter picture_id), and _Deletepicture (parameter picture_id).
8.8
Haute
CVE-2019-9692 2019-03-11 17h00 +00:00 class.showtime2_image.php in CMS Made Simple (CMSMS) before 2.2.10 does not ensure that a watermark file has a standard image file extension (GIF, JPG, JPEG, or PNG).
6.5
Moyen
CVE-2018-10515 2018-04-27 18h00 +00:00 In CMS Made Simple (CMSMS) through 2.2.7, the "file unpack" operation in the admin dashboard contains a remote code execution vulnerability exploitable by an admin user because a .php file can be present in the extracted ZIP archive.
7.2
Haute
CVE-2018-10516 2018-04-27 18h00 +00:00 In CMS Made Simple (CMSMS) through 2.2.7, the "file rename" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitable by an admin user, that can cause DoS by moving config.php to the upload/ directory.
6.5
Moyen
CVE-2018-10518 2018-04-27 18h00 +00:00 In CMS Made Simple (CMSMS) through 2.2.7, the "file delete" operation in the admin dashboard contains an arbitrary file deletion vulnerability that can cause DoS, exploitable by an admin user, because the attacker can remove all lib/ files in all directories.
6.5
Moyen
CVE-2018-10520 2018-04-27 18h00 +00:00 In CMS Made Simple (CMSMS) through 2.2.7, the "module remove" operation in the admin dashboard contains an arbitrary file deletion vulnerability that can cause DoS, exploitable by an admin user, because the attacker can remove all lib/ files in all directories.
6.5
Moyen
CVE-2018-10521 2018-04-27 18h00 +00:00 In CMS Made Simple (CMSMS) through 2.2.7, the "file move" operation in the admin dashboard contains an arbitrary file movement vulnerability that can cause DoS, exploitable by an admin user, because config.php can be moved into an incorrect directory.
2.7
Bas
CVE-2018-10522 2018-04-27 18h00 +00:00 In CMS Made Simple (CMSMS) through 2.2.7, the "file view" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitable by ordinary users, because the product exposes unrestricted access to the PHP file_get_contents function.
4.9
Moyen
CVE-2018-10523 2018-04-27 18h00 +00:00 CMS Made Simple (CMSMS) through 2.2.7 contains a physical path leakage Vulnerability via /modules/DesignManager/action.ajax_get_templates.php, /modules/DesignManager/action.ajax_get_stylesheets.php, /modules/FileManager/dunzip.php, or /modules/FileManager/untgz.php.
5.3
Moyen
CVE-2018-10517 2018-04-27 16h00 +00:00 In CMS Made Simple (CMSMS) through 2.2.7, the "module import" operation in the admin dashboard contains a remote code execution vulnerability, exploitable by an admin user, because an XML Package can contain base64-encoded PHP code in a data element.
7.2
Haute
CVE-2018-10081 2018-04-13 05h00 +00:00 CMS Made Simple (CMSMS) through 2.2.6 contains an admin password reset vulnerability because data values are improperly compared, as demonstrated by a hash beginning with the "0e" substring.
9.8
Critique
CVE-2018-10082 2018-04-13 05h00 +00:00 CMS Made Simple (CMSMS) through 2.2.7 allows physical path leakage via an invalid /index.php?page= value, a crafted URI starting with /index.php?mact=Search, or a direct request to /admin/header.php, /admin/footer.php, /lib/tasks/class.ClearCache.task.php, or /lib/tasks/class.CmsSecurityCheck.task.php.
5.3
Moyen
CVE-2018-10083 2018-04-13 05h00 +00:00 CMS Made Simple (CMSMS) through 2.2.7 contains an arbitrary file deletion vulnerability in the admin dashboard via directory traversal sequences in the val parameter within a cmd=del request, because code under modules\FilePicker does not restrict the val parameter.
7.5
Haute
CVE-2018-10084 2018-04-13 05h00 +00:00 CMS Made Simple (CMSMS) through 2.2.6 contains a privilege escalation vulnerability from ordinary user to admin user by arranging for the eff_uid value within $_COOKIE[$this->_loginkey] to equal 1, because an SHA-1 cryptographic protection mechanism can be bypassed.
8.8
Haute
CVE-2018-10085 2018-04-13 05h00 +00:00 CMS Made Simple (CMSMS) through 2.2.6 allows PHP object injection because of an unserialize call in the _get_data function of \lib\classes\internal\class.LoginOperations.php. By sending a crafted cookie, a remote attacker can upload and execute code, or delete files.
9.8
Critique
CVE-2018-10086 2018-04-13 05h00 +00:00 CMS Made Simple (CMSMS) through 2.2.7 contains an arbitrary code execution vulnerability in the admin dashboard because the implementation uses "eval('function testfunction'.rand()" and it is possible to bypass certain restrictions on these "testfunction" functions.
7.2
Haute
CVE-2018-10029 2018-04-11 19h00 +00:00 CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_name parameter, related to moduledepends, a different vulnerability than CVE-2017-16799.
4.8
Moyen
CVE-2018-10030 2018-04-11 19h00 +00:00 CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/siteprefs.php.
8.8
Haute
CVE-2018-10031 2018-04-11 19h00 +00:00 CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/moduleinterface.php.
8.8
Haute
CVE-2018-10032 2018-04-11 19h00 +00:00 CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_version parameter.
4.8
Moyen
CVE-2018-10033 2018-04-11 19h00 +00:00 CMS Made Simple (aka CMSMS) 2.2.7 has Stored XSS in admin/siteprefs.php via the metadata parameter.
4.8
Moyen
CVE-2017-1000453 2018-01-02 17h00 +00:00 CMS Made Simple version 2.1.6 and 2.2 are vulnerable to Smarty templating injection in some core modules, resulting in unauthenticated PHP code execution.
9.8
Critique
CVE-2017-1000454 2018-01-02 17h00 +00:00 CMS Made Simple 2.1.6, 2.2, 2.2.1 are vulnerable to Smarty Template Injection in some core components, resulting in local file read before 2.2, and local file inclusion since 2.2.1
7.8
Haute
CVE-2017-17734 2017-12-18 06h00 +00:00 CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in sessions.
9.8
Critique
CVE-2017-17735 2017-12-18 06h00 +00:00 CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in cookies.
9.8
Critique
CVE-2017-6070 2017-02-21 06h46 +00:00 CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to execute PHP code via the cntnt01fbrp_forma_form_template parameter in admin_store_form.
9.8
Critique
CVE-2017-6071 2017-02-21 06h46 +00:00 CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via exportxml.
5.3
Moyen
CVE-2017-6072 2017-02-21 06h46 +00:00 CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via defaultadmin.
5.3
Moyen
CVE-2016-7904 2017-01-16 05h00 +00:00 Cross-site request forgery (CSRF) vulnerability in CMS Made Simple before 2.1.6 allows remote attackers to hijack the authentication of administrators for requests that create accounts via an admin/adduser.php request.
8
Haute
CVE-2016-2784 2016-05-26 12h00 +00:00 CMS Made Simple 2.x before 2.1.3 and 1.x before 1.12.2, when Smarty Cache is activated, allow remote attackers to conduct cache poisoning attacks, modify links, and conduct cross-site scripting (XSS) attacks via a crafted HTTP Host header in a request.
4.7
Moyen
CVE-2014-2245 2014-03-05 14h00 +00:00 SQL injection vulnerability in the News module in CMS Made Simple (CMSMS) before 1.11.10 allows remote authenticated users with the "Modify News" permission to execute arbitrary SQL commands via the sortby parameter to admin/moduleinterface.php. NOTE: some of these details are obtained from third party information.
6
CVE-2014-0334 2014-03-02 16h00 +00:00 Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple allow remote authenticated users to inject arbitrary web script or HTML via (1) the group parameter to admin/addgroup.php, (2) the htmlblob parameter to admin/addhtmlblob.php, the (3) title or (4) url parameter to admin/addbookmark.php, (5) the stylesheet_name parameter to admin/copystylesheet.php, (6) the template_name parameter to admin/copytemplate.php, the (7) title or (8) url parameter to admin/editbookmark.php, (9) the template parameter to admin/listtemplates.php, or (10) the css_name parameter to admin/listcss.php, a different issue than CVE-2014-2092.
3.5
CVE-2013-4167 2013-10-11 22h00 +00:00 Cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) before 1.11.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
4.3
CVE-2012-5450 2012-12-03 20h00 +00:00 Cross-site request forgery (CSRF) vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) 1.11.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deld parameter.
6.8
CVE-2012-6064 2012-12-03 20h00 +00:00 Directory traversal vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) before 1.11.2.1 allows remote authenticated administrators to delete arbitrary files via a .. (dot dot) in the deld parameter. NOTE: this can be leveraged using CSRF (CVE-2012-5450) to allow remote attackers to delete arbitrary files.
3.5
CVE-2012-1992 2012-04-11 08h00 +00:00 Cross-site scripting (XSS) vulnerability in admin/edituser.php in CMS Made Simple 1.10.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the email parameter (aka the Email Address field in the Edit User template).
4.3
CVE-2010-4663 2011-06-08 10h00 +00:00 Unspecified vulnerability in the News module in CMS Made Simple (CMSMS) before 1.9.1 has unknown impact and attack vectors.
10
CVE-2010-2797 2010-10-08 20h00 +00:00 Directory traversal vulnerability in lib/translation.functions.php in CMS Made Simple before 1.8.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the default_cms_lang parameter to an admin script, as demonstrated by admin/addbookmark.php, a different vulnerability than CVE-2008-5642.
7.5
CVE-2010-3882 2010-10-08 20h00 +00:00 Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple 1.7.1 and earlier allow remote attackers to inject arbitrary web script or HTML via input to the (1) Add Pages, (2) Add Global Content, (3) Edit Global Content, (4) Add Article, (5) Add Category, (6) Add Field Definition, or (7) Add Shortcut module.
4.3
CVE-2010-3883 2010-10-08 20h00 +00:00 Cross-site request forgery (CSRF) vulnerability in the Change Group Permissions module in CMS Made Simple 1.7.1 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that make permission modifications.
6.8
CVE-2010-3884 2010-10-08 20h00 +00:00 Cross-site request forgery (CSRF) vulnerability in CMS Made Simple 1.8.1 and earlier allows remote attackers to hijack the authentication of administrators for requests that reset the administrative password. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
6.8
CVE-2010-1482 2010-05-12 15h00 +00:00 Cross-site scripting (XSS) vulnerability in admin/editprefs.php in the backend in CMS Made Simple (CMSMS) before 1.7.1 might allow remote attackers to inject arbitrary web script or HTML via the date_format_string parameter.
4.3
CVE-2007-6656 2008-01-04 10h00 +00:00 SQL injection vulnerability in content_css.php in the TinyMCE module for CMS Made Simple 1.2.2 and earlier allows remote attackers to execute arbitrary SQL commands via the templateid parameter.
7.5
CVE-2007-5056 2007-09-24 20h00 +00:00 Eval injection vulnerability in adodb-perf-module.inc.php in ADOdb Lite 1.42 and earlier, as used in products including CMS Made Simple, SAPID CMF, Journalness, PacerCMS, and Open-Realty, allows remote attackers to execute arbitrary code via PHP sequences in the last_module parameter.
6.8
CVE-2007-2473 2007-05-02 21h00 +00:00 SQL injection vulnerability in stylesheet.php in CMS Made Simple 1.0.5 and earlier allows remote attackers to execute arbitrary SQL commands via the templateid parameter.
7.5