CMS Made Simple up to 2.2.7 filepicker cmd=del path traversal

Summaryinfo

A vulnerability classified as problematic has been found in CMS Made Simple up to 2.2.7. This vulnerability affects unknown code of the component filepicker. This manipulation of the argument cmd=del as part of Parameter causes path traversal. This vulnerability is registered as CVE-2018-10083. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability has been found in CMS Made Simple up to 2.2.7 (Content Management System) and classified as critical. Affected by this vulnerability is some unknown processing of the component filepicker. The manipulation of the argument cmd=del as part of a Parameter leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

CMS Made Simple (CMSMS) through 2.2.7 contains an arbitrary file deletion vulnerability in the admin dashboard via directory traversal sequences in the val parameter within a cmd=del request, because code under modules\FilePicker does not restrict the val parameter.

The bug was discovered 04/13/2018. The weakness was published 04/13/2018 (Website). The advisory is shared at github.com. This vulnerability is known as CVE-2018-10083 since 04/13/2018. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Similar entries are available at VDB-116187, VDB-116186, VDB-116183 and VDB-116184. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Content Management System

Name

• CMS Made Simple

Version

• 2.2.0
• 2.2.1
• 2.2.2
• 2.2.3
• 2.2.4
• 2.2.5
• 2.2.6
• 2.2.7

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion