CVE-2023-36969

published 2023-07-06

CVE-2023-36969: CMS Made Simple v2.2.17 is vulnerable to Remote Command Execution via the File Upload Function.

Priority P2 74 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

EXPLOIT

CMS Made Simple v2.2.17 is vulnerable to Remote Command Execution via the File Upload Function.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
cmsmadesimple	cms_made_simple	—	—

Detection & IOCs extracted from sources · hover to see the quote

path /uploads/↗

filename .phar↗

filename .phtml↗

• → Monitor for uploads of files with .phar or .phtml extensions to the CMS Made Simple file manager, as these are the attack vectors for RCE. ↗
• → Alert on HTTP GET requests to /uploads/ for files with .phar or .phtml extensions, which indicates post-upload execution of a webshell. ↗

• · Exploitation requires authenticated administrator access; this is not an unauthenticated RCE. Prioritize detection of compromised admin credentials as a precursor. ↗
• · Affected versions span a wide range (v2.2.14 through v2.2.21); ensure version-based detection or patching covers all listed versions. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434