CVE-2018-1000094

high · 7.2

CMS Made Simple version 2.2.5 contains a Remote Code Execution vulnerability in File Manager that can result in Allows an authenticated admin that has access to the file manager to execute code on the server. This attack appear to be exploitable via File upload -> copy to any extension.

7.2

CVSS

38.8%

EPSS (exploit prob.)

99th

EPSS percentile

2018-03-13

Published

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-434

Affected products

Vendor	Product	Affected versions
cmsmadesimple	cms_made_simple	2.2.5

Check a specific version with /api/v1/cve/match.

References

http://dev.cmsmadesimple.org/bug/view/11741
https://www.exploit-db.com/exploits/44976/
http://dev.cmsmadesimple.org/bug/view/11741
https://www.exploit-db.com/exploits/44976/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2018-1000094