CMS Made Simple 2.1.6 admin/editusertag.php CreateTagFunction/CallUserTag code code injection ⚔ [Disputed]

Summaryinfo

A vulnerability was found in CMS Made Simple 2.1.6. It has been declared as critical. Affected is the function CreateTagFunction/CallUserTag of the file admin/editusertag.php. The manipulation of the argument code results in code injection. This vulnerability is known as CVE-2017-8912. It is possible to launch the attack remotely. Furthermore, an exploit is available. The real existence of this vulnerability is still doubted at the moment.

Detailsinfo

A vulnerability, which was classified as critical, was found in CMS Made Simple 2.1.6 (Content Management System). Affected is the function CreateTagFunction/CallUserTag of the file admin/editusertag.php. The manipulation of the argument code with an unknown input leads to a code injection vulnerability. CWE is classifying the issue as CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

** DISPUTED ** CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated administrators to execute arbitrary PHP code via the code parameter to admin/editusertag.php, related to the CreateTagFunction and CallUserTag functions. NOTE: the vendor reportedly has stated this is "a feature, not a bug."

The weakness was published 05/12/2017 (Website). The advisory is shared for download at exploit-db.com. This vulnerability is traded as CVE-2017-8912 since 05/12/2017. It is possible to launch the attack remotely. Required for exploitation is a authentication. Technical details and a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1059.

A public exploit has been developed by Osanda Malith in HTTP POST Request and been published even before and not after the advisory. The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 2 days. During that time the estimated underground price was around $0-$5k. The real existence of this vulnerability is still doubted at the moment. By approaching the search of inurl:admin/editusertag.php it is possible to find vulnerable targets with Google Hacking. The code used by the exploit is:

POST /cmsms/admin/editusertag.php?_sk_=2a7da2216d41e0ac&userplugin_id=4 HTTP/1.1
 
_sk_=2a7da2216d41e0ac&userplugin_id=4&userplugin_name=aaa&code=passthru('dir')%3B&description=&run=1&apply=1&ajax=1

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Exploit-DB (41997). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Content Management System

Name

• CMS Made Simple

Version

• 2.1.6

License

• open-source

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Duplicate

• Submit #XXXXXX: Xxxx Xxxxxxxxx Xxxxxxxxxxxxx Xx Xxx Xxxx Xxxxxx Xx.x.xx Xxx Xxxx Xxxxxx X.x.xx Xxxx Xxxxxxxxx (by testvul)

Once again VulDB remains the best source for vulnerability data.

Discussion