CVE-2024-27622

A remote code execution vulnerability has been identified in the User Defined Tags module of CMS Made Simple version 2.2.19 / 2.2.21. This vulnerability arises from inadequate sanitization of user-supplied input in the 'Code' section of the module. As a result, authenticated users with administrative privileges can inject and execute arbitrary PHP code.

CVSS v3.1

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

1.98% chance of exploitation in the next 30 days, 79th percentile

Published

2024-03-05

Updated

2024-08-19

Proof-of-concept exploits (1)

• https://www.vicarius.io/vsociety/posts/pwning-cmsms-via-user-defined-tags-for-fun-and-lea…

References

• CVE Record
• NVD entry

Related

• CVE-2024-27620
• CVE-2024-27623
• CVE-2024-2762
• CVE-2024-2763
• CVE-2024-27612
• CVE-2024-27630