Skip to content

CVE-2018-10085 CMS Made Simple (CMSMS) through 2.2.6 allows PHP object injection because of an unserialize call in the _get_data function of \lib\classes\internal\class.LoginOperations.php. By sending a crafted cook...

CriticalCVSS 9.8 EPSS 3.8%
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

CMS Made Simple (CMSMS) through 2.2.6 allows PHP object injection because of an unserialize call in the _get_data function of \lib\classes\internal\class.LoginOperations.php. By sending a crafted cookie, a remote attacker can upload and execute code, or delete files.

Affected products

ProductAffected versionsFixed in
cmsmadesimple cms made simple <= 2.2.6 No fix listed

References

  • github.com exploit technical-description third-party-advisory