CVE-2011-0635 Static code injection vulnerability in Simploo CMS 1.7.1 and earlier allows remote authenticated users to inject arbitrary PHP code into config/custom/base.ini.php via the ftpserver parameter (FTP-Ser...
MediumCVSS 6.0
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Static code injection vulnerability in Simploo CMS 1.7.1 and earlier allows remote authenticated users to inject arbitrary PHP code into config/custom/base.ini.php via the ftpserver parameter (FTP-Server field) to the sicore/updates/optionssav operation for index.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| simploo cms | <= 1.7.1 | No fix listed |
| simploo cms | = 1.2.0 | No fix listed |
| simploo cms | = 1.3.0 | No fix listed |
| simploo cms | = 1.5.0 | No fix listed |
| simploo cms | = 1.5.2 | No fix listed |
| simploo cms | = 1.7.0 | No fix listed |
References
- 70487 vdb-entry
- 42953 third-party-advisory vendor-advisory
- 16016 exploit
- 20110118 Simploo CMS Community Edition - Remote PHP Code Execution Issue mailing-list
- 45906 exploit vdb-entry
- simploocms-ftpserver-code-execution(64826) vdb-entry