CVE-2016-7904 in CMS Made Simple
Summary
by MITRE
Cross-site request forgery (CSRF) vulnerability in CMS Made Simple before 2.1.6 allows remote attackers to hijack the authentication of administrators for requests that create accounts via an admin/adduser.php request.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 05/13/2026
The CVE-2016-7904 vulnerability represents a critical cross-site request forgery flaw in CMS Made Simple versions prior to 2.1.6 that fundamentally undermines the application's administrative security controls. This vulnerability operates by exploiting the absence of proper anti-CSRF protection mechanisms within the admin/adduser.php endpoint, which is designed to handle user account creation requests. The flaw enables remote attackers to craft malicious web pages or links that can automatically submit administrative account creation requests without the knowledge or consent of legitimate administrators, effectively allowing unauthorized privilege escalation through automated attack vectors.
The technical implementation of this vulnerability stems from the application's failure to validate request origins and implement proper anti-CSRF tokens for administrative operations. When an administrator visits a malicious page containing crafted requests targeting the vulnerable adduser.php endpoint, the application processes these requests as legitimate administrative commands due to the missing validation checks. This creates a dangerous scenario where attackers can programmatically create new administrative accounts with predetermined credentials, bypassing normal authentication mechanisms entirely. The vulnerability specifically affects the administrative user management functionality and represents a direct violation of the principle of least privilege by enabling unauthorized account creation within the system's administrative domain.
The operational impact of CVE-2016-7904 is severe and far-reaching within the context of content management systems and web application security. Successful exploitation provides attackers with persistent administrative access to the CMS platform, allowing them to modify website content, install malicious plugins, access sensitive user data, and potentially use the compromised system as a pivot point for attacking other systems within the network. This vulnerability directly maps to attack patterns described in the MITRE ATT&CK framework under the privilege escalation and persistence categories, specifically targeting the 'Web Application Attack Surface' and 'Command and Control' domains. Organizations using vulnerable versions of CMS Made Simple face significant risk of complete system compromise, data breaches, and unauthorized content manipulation that can persist even after the initial attack vector is patched.
Organizations should prioritize immediate remediation through the application of the official CMS Made Simple 2.1.6 patch or subsequent versions that implement proper CSRF protection mechanisms. The fix typically involves implementing anti-CSRF tokens for administrative operations and validating request origins through proper referer header checks or custom token validation. Security teams should also conduct comprehensive vulnerability assessments of their CMS environments to identify other potentially vulnerable administrative endpoints that may lack similar protection mechanisms. Additional mitigations include implementing web application firewalls with CSRF protection rules, restricting administrative access through network segmentation, and establishing robust monitoring for unauthorized account creation activities. The vulnerability aligns with CWE-352, which specifically addresses cross-site request forgery weaknesses in web applications, and represents a critical security gap that requires immediate attention to prevent unauthorized administrative access and potential full system compromise.