CVE-2019-9692

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

45.90%

Published

Mar 11, 2019

Modified

Nov 21, 2024

Public PoC / Exploit (3)

All weaponized →

Exploit-DBCMS Made Simple (CMSMS) Showtime2 - File Upload Remote Code Execution (Metasploit)Exploit-DBCMS Made Simple Showtime2 Module 3.6.2 - (Authenticated) Arbitrary File Upload TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

class.showtime2_image.php in CMS Made Simple (CMSMS) before 2.2.10 does not ensure that a watermark file has a standard image file extension (GIF, JPG, JPEG, or PNG).

Weaknesses (CWE)

CWE-434

Affected Products (1)

cmsmadesimple · cms_made_simple (up to 2.2.10)vulnerable

References (12)

http://packetstormsecurity.com/files/152269/CMS-Made-Simple-CMSMS-Showtime2-File-Upload-Remote-Command-Execution.html

ExploitThird Party AdvisoryVDB Entry

http://viewsvn.cmsmadesimple.org/diff.php?repname=showtime2&path=%2Ftrunk%2Flib%2Fclass.showtime2_image.php&rev=47

PatchVendor Advisory

http://www.rapid7.com/db/modules/exploit/multi/http/cmsms_showtime2_rce

Third Party Advisory

https://forum.cmsmadesimple.org/viewtopic.php?f=1&t=80285

Vendor Advisory

https://www.exploit-db.com/exploits/46546/

ExploitThird Party AdvisoryVDB Entry

https://www.exploit-db.com/exploits/46627/

ExploitThird Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/152269/CMS-Made-Simple-CMSMS-Showtime2-File-Upload-Remote-Command-Execution.html

ExploitThird Party AdvisoryVDB Entry

http://viewsvn.cmsmadesimple.org/diff.php?repname=showtime2&path=%2Ftrunk%2Flib%2Fclass.showtime2_image.php&rev=47

PatchVendor Advisory

http://www.rapid7.com/db/modules/exploit/multi/http/cmsms_showtime2_rce

Third Party Advisory

https://forum.cmsmadesimple.org/viewtopic.php?f=1&t=80285

Vendor Advisory

https://www.exploit-db.com/exploits/46546/

ExploitThird Party AdvisoryVDB Entry

https://www.exploit-db.com/exploits/46627/

ExploitThird Party AdvisoryVDB Entry

KEV Catalog EPSS Scores Vendors All CVEs