CVE-2017-6070 CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to execute PHP code via the cntnt01fbrp_forma_form_template parameter in admin_store_form.
CriticalCVSS 9.8
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to execute PHP code via the cntnt01fbrp_forma_form_template parameter in admin_store_form.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cmsmadesimple form builder | <= 0.8.1.5 | No fix listed |
| cmsmadesimple cms made simple | <= 1.12.2 | No fix listed |
References
- dev.cmsmadesimple.org product
- daylight-it.com exploit third-party-advisory