Test ID:	1.3.6.1.4.1.25623.1.0.113655
Category:	Web application abuses
Title:	CMS Made Simple <= 2.2.15 Multiple Vulnerabilities
Summary:	CMS Made Simple is prone to multiple vulnerabilities.
Description:	Summary: CMS Made Simple is prone to multiple vulnerabilities. Vulnerability Insight: The following vulnerabilities exist: - CVE-2020-10681: Stored XSS vulnerability by sending a crafted .pxd file via the m1_files[] parameter to admin/moduleinterface.php - CVE-2020-10682: Remote Code Execution vulnerability by sending a crafted .php.jpegd JPEG file via the m1_files[] parameter to admin/moduleinterface.php Vulnerability Impact: Successful exploitation would allow an attacker to inject arbitrary HTML or JavaScript into the site or execute arbitrary commands on the target machine. Affected Software/OS: CMS Made Simple through version 2.2.15. Solution: No known solution was made available for at least one year since the disclosure of this vulnerability. Likely none will be provided anymore. General solution options are to upgrade to a newer release, disable respective features, remove the product or replace the product by another one. CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2020-10681 http://dev.cmsmadesimple.org/bug/view/12274 Common Vulnerability Exposure (CVE) ID: CVE-2020-10682 http://dev.cmsmadesimple.org/bug/view/12275
Copyright	Copyright (C) 2020 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.