CVE-2024-27622

A remote code execution vulnerability has been identified in the User Defined Tags module of CMS Made Simple version 2.2.19 / 2.2.21. This vulnerability arises from inadequate sanitization of user-supplied input in the 'Code' section of the module. As a result, authenticated users with administrative privileges can inject and execute arbitrary PHP code.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/capture0x/CMSMadeSimple/	Exploit Third Party Advisory
https://packetstormsecurity.com/files/177241/CMS-Made-Simple-2.2.19-Remote-Code-Execution.html	Exploit VDB Entry
https://github.com/capture0x/CMSMadeSimple/	Exploit Third Party Advisory
https://packetstormsecurity.com/files/177241/CMS-Made-Simple-2.2.19-Remote-Code-Execution.html	Exploit VDB Entry
https://www.vicarius.io/vsociety/posts/pwning-cmsms-via-user-defined-tags-for-fun-and-learning-cve-2024-27622-27623	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.19:::::::*
	cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.21:::::::*

History

No history.

Information

Published : 2024-03-05 14:15

Updated : 2025-03-28 16:05

NVD link : CVE-2024-27622

Mitre link : CVE-2024-27622

CVE.ORG link : CVE-2024-27622

JSON object : View

Products Affected

cmsmadesimple

cms_made_simple

CWE

CWE-75

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2024-27622", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2024-03-05T14:15:49.030", "references": [{"url": "https://github.com/capture0x/CMSMadeSimple/", "tags": ["Exploit", "Third Party Advisory"], "source": "[email protected]"}, {"url": "https://packetstormsecurity.com/files/177241/CMS-Made-Simple-2.2.19-Remote-Code-Execution.html", "tags": ["Exploit", "VDB Entry"], "source": "[email protected]"}, {"url": "https://github.com/capture0x/CMSMadeSimple/", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://packetstormsecurity.com/files/177241/CMS-Made-Simple-2.2.19-Remote-Code-Execution.html", "tags": ["Exploit", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.vicarius.io/vsociety/posts/pwning-cmsms-via-user-defined-tags-for-fun-and-learning-cve-2024-27622-27623", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-75"}, {"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "A remote code execution vulnerability has been identified in the User Defined Tags module of CMS Made Simple version 2.2.19 / 2.2.21. This vulnerability arises from inadequate sanitization of user-supplied input in the 'Code' section of the module. As a result, authenticated users with administrative privileges can inject and execute arbitrary PHP code."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo en el m\u00f3dulo Etiquetas definidas por el usuario de CMS Made Simple versi\u00f3n 2.2.19. Esta vulnerabilidad surge de una sanitizaci\u00f3n inadecuada de la entrada proporcionada por el usuario en la secci\u00f3n \"C\u00f3digo\" del m\u00f3dulo. Como resultado, los usuarios autenticados con privilegios administrativos pueden inyectar y ejecutar c\u00f3digo PHP arbitrario."}], "lastModified": "2025-03-28T16:05:54.780", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.19:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BB09A515-0F41-407D-AD7B-908F4341358A"}, {"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.21:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "55BFD129-4009-4D56-B161-EA6135366AC0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}