CMSimple 5.15 contains a remote command execution vulnerability that allows authenticated attackers to modify file extensions and upload malicious PHP files. Attackers can append ,php to Extensions_userfiles and upload a shell script to the media directory to execute arbitrary code on the server.
A process does not close sensitive file descriptors before invoking a child process, which allows the child to perform unauthorized I/O operations using those descriptors.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Cmsimple | Cmsimple | 5.15 (including) | 5.15 (including) |