CVE-2014-8790 XML external entity (XXE) vulnerability in admin/api.php in GetSimple CMS 3.1.1 through 3.3.x before 3.3.5 Beta 1, when in certain configurations, allows remote attackers to read arbitrary files via t...
MediumCVSS 5.0
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
XML external entity (XXE) vulnerability in admin/api.php in GetSimple CMS 3.1.1 through 3.3.x before 3.3.5 Beta 1, when in certain configurations, allows remote attackers to read arbitrary files via the data parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cagintranetworks getsimple cms | = 3.3.3 | No fix listed |
| cagintranetworks getsimple cms | = 3.3.4 | No fix listed |
| get-simple getsimple cms | = 3.1.1 | No fix listed |
| get-simple getsimple cms | = 3.1.2 | No fix listed |
| get-simple getsimple cms | = 3.2 | No fix listed |
| get-simple getsimple cms | = 3.2.1 | No fix listed |
| get-simple getsimple cms | = 3.2.2 | No fix listed |
| get-simple getsimple cms | = 3.2.3 | No fix listed |
| get-simple getsimple cms | = 3.3.0 | No fix listed |
| get-simple getsimple cms | = 3.3.1 | No fix listed |
| get-simple getsimple cms | = 3.3.2-b3 | No fix listed |
References
- get-simple.info
- karmainsecurity.com exploit
- packetstormsecurity.com exploit
- 20141231 [KIS-2014-17] GetSimple CMS <= 3.3.4 (api.php) XML External Entity Vulnerability exploit mailing-list
- github.com