CVE-2018-10515

In CMS Made Simple (CMSMS) through 2.2.7, the "file unpack" operation in the admin dashboard contains a remote code execution vulnerability exploitable by an admin user because a .php file can be present in the extracted ZIP archive.

Score

CVSS 3.0 7.2 High

Status

Modified - cve@mitre.org

Published

2018-04-27

Last modified

2024-09-16

Weaknesses

CWE-94

Affected products

• Cms Made Simple (Cmsmadesimple)

References

• https://github.com/itodaro/cmsms_cve/blob/master/README.md