Vulnerabilities > CVE-2019-9055 - Deserialization of Untrusted Data vulnerability in Cmsmadesimple CMS Made Simple

CVSS 6.5 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

SINGLE

Confidentiality impact

PARTIAL

Integrity impact

PARTIAL

Availability impact

PARTIAL

network

low complexity

cmsmadesimple

CWE-502

metasploit

NVD

Published: 2019-03-26

Updated: 2020-08-24

Summary

An issue was discovered in CMS Made Simple 2.2.8. In the module DesignManager (in the files action.admin_bulk_css.php and action.admin_bulk_template.php), with an unprivileged user with Designer permission, it is possible reach an unserialize call with a crafted value in the m1_allparms parameter, and achieve object injection.

Vulnerable Configurations

Part	Description	Count
Application	Cmsmadesimple Cmsmadesimple CMS Made Simple - Cmsmadesimple CMS Made Simple 0.1 Cmsmadesimple CMS Made Simple 0.2 Cmsmadesimple CMS Made Simple 0.2.1 Cmsmadesimple CMS Made Simple 0.3 Cmsmadesimple CMS Made Simple 0.3.1 Cmsmadesimple CMS Made Simple 0.3.2 Cmsmadesimple CMS Made Simple 0.4 Cmsmadesimple CMS Made Simple 0.4.1 Cmsmadesimple CMS Made Simple 0.5 Cmsmadesimple CMS Made Simple 0.5.1 Cmsmadesimple CMS Made Simple 0.6 Cmsmadesimple CMS Made Simple 0.6.1 Cmsmadesimple CMS Made Simple 0.6.2 Cmsmadesimple CMS Made Simple 0.6.3 Cmsmadesimple CMS Made Simple 0.7 Cmsmadesimple CMS Made Simple 0.7.1 Cmsmadesimple CMS Made Simple 0.7.2 Cmsmadesimple CMS Made Simple 0.7.3 Cmsmadesimple CMS Made Simple 0.8 Cmsmadesimple CMS Made Simple 0.8.1 Cmsmadesimple CMS Made Simple 0.8.2 Cmsmadesimple CMS Made Simple 0.9 Cmsmadesimple CMS Made Simple 0.9.1 Cmsmadesimple CMS Made Simple 0.9.2 Cmsmadesimple CMS Made Simple 0.10 Cmsmadesimple CMS Made Simple 0.10.1 Cmsmadesimple CMS Made Simple 0.10.2 Cmsmadesimple CMS Made Simple 0.10.3 Cmsmadesimple CMS Made Simple 0.10.4 Cmsmadesimple CMS Made Simple 0.11 Cmsmadesimple CMS Made Simple 0.11.1 Cmsmadesimple CMS Made Simple 0.11.2 Cmsmadesimple CMS Made Simple 0.12 Cmsmadesimple CMS Made Simple 0.12.1 Cmsmadesimple CMS Made Simple 0.12.2 Cmsmadesimple CMS Made Simple 0.13 Cmsmadesimple CMS Made Simple 1.0 Cmsmadesimple CMS Made Simple 1.0.1 Cmsmadesimple CMS Made Simple 1.0.2 Cmsmadesimple CMS Made Simple 1.0.3 Cmsmadesimple CMS Made Simple 1.0.4 Cmsmadesimple CMS Made Simple 1.0.5 Cmsmadesimple CMS Made Simple 1.0.6 Cmsmadesimple CMS Made Simple 1.0.7 Cmsmadesimple CMS Made Simple 1.0.8 Cmsmadesimple CMS Made Simple 1.1 Cmsmadesimple CMS Made Simple 1.1.1 Cmsmadesimple CMS Made Simple 1.1.2 Cmsmadesimple CMS Made Simple 1.1.2.1 Cmsmadesimple CMS Made Simple 1.1.3 Cmsmadesimple CMS Made Simple 1.1.3.1 Cmsmadesimple CMS Made Simple 1.1.4 Cmsmadesimple CMS Made Simple 1.1.4.1 Cmsmadesimple CMS Made Simple 1.2 Cmsmadesimple CMS Made Simple 1.2.1 Cmsmadesimple CMS Made Simple 1.2.2 Cmsmadesimple CMS Made Simple 1.2.3 Cmsmadesimple CMS Made Simple 1.2.4 Cmsmadesimple CMS Made Simple 1.2.5 Cmsmadesimple CMS Made Simple 1.3 Cmsmadesimple CMS Made Simple 1.3.1 Cmsmadesimple CMS Made Simple 1.4 Cmsmadesimple CMS Made Simple 1.4.1 Cmsmadesimple CMS Made Simple 1.5 Cmsmadesimple CMS Made Simple 1.5.1 Cmsmadesimple CMS Made Simple 1.5.2 Cmsmadesimple CMS Made Simple 1.5.3 Cmsmadesimple CMS Made Simple 1.5.4 Cmsmadesimple CMS Made Simple 1.6 Cmsmadesimple CMS Made Simple 1.6.1 Cmsmadesimple CMS Made Simple 1.6.2 Cmsmadesimple CMS Made Simple 1.6.3 Cmsmadesimple CMS Made Simple 1.6.4 Cmsmadesimple CMS Made Simple 1.6.5 Cmsmadesimple CMS Made Simple 1.6.6 Cmsmadesimple CMS Made Simple 1.6.7 Cmsmadesimple CMS Made Simple 1.6.8 Cmsmadesimple CMS Made Simple 1.6.9 Cmsmadesimple CMS Made Simple 1.6.10 Cmsmadesimple CMS Made Simple 1.7 Cmsmadesimple CMS Made Simple 1.7.1 Cmsmadesimple CMS Made Simple 1.8 Cmsmadesimple CMS Made Simple 1.8.1 Cmsmadesimple CMS Made Simple 1.8.2 Cmsmadesimple CMS Made Simple 1.9 Cmsmadesimple CMS Made Simple 1.9.1 Cmsmadesimple CMS Made Simple 1.9.2 Cmsmadesimple CMS Made Simple 1.9.3 Cmsmadesimple CMS Made Simple 1.9.4 Cmsmadesimple CMS Made Simple 1.9.4.1 Cmsmadesimple CMS Made Simple 1.9.4.2 Cmsmadesimple CMS Made Simple 1.9.4.3 Cmsmadesimple CMS Made Simple 1.10 Cmsmadesimple CMS Made Simple 1.10.1 Cmsmadesimple CMS Made Simple 1.10.2 Cmsmadesimple CMS Made Simple 1.10.3 Cmsmadesimple CMS Made Simple 1.11 Cmsmadesimple CMS Made Simple 1.11.1 Cmsmadesimple CMS Made Simple 1.11.2 Cmsmadesimple CMS Made Simple 1.11.2.1 Cmsmadesimple CMS Made Simple 1.11.3 Cmsmadesimple CMS Made Simple 1.11.4 Cmsmadesimple CMS Made Simple 1.11.5 Cmsmadesimple CMS Made Simple 1.11.6 Cmsmadesimple CMS Made Simple 1.11.7 Cmsmadesimple CMS Made Simple 1.11.8 Cmsmadesimple CMS Made Simple 1.11.9 Cmsmadesimple CMS Made Simple 1.11.10 Cmsmadesimple CMS Made Simple 1.11.11 Cmsmadesimple CMS Made Simple 1.11.12 Cmsmadesimple CMS Made Simple 1.11.13 Cmsmadesimple CMS Made Simple 1.12 Cmsmadesimple CMS Made Simple 1.12.1 Cmsmadesimple CMS Made Simple 1.12.2 Cmsmadesimple CMS Made Simple 2.0 Cmsmadesimple CMS Made Simple 2.0.1 Cmsmadesimple CMS Made Simple 2.0.1.1 Cmsmadesimple CMS Made Simple 2.1 Cmsmadesimple CMS Made Simple 2.1.1 Cmsmadesimple CMS Made Simple 2.1.2 Cmsmadesimple CMS Made Simple 2.1.3 Cmsmadesimple CMS Made Simple 2.1.4 Cmsmadesimple CMS Made Simple 2.1.5 Cmsmadesimple CMS Made Simple 2.1.6 Cmsmadesimple CMS Made Simple 2.2 Cmsmadesimple CMS Made Simple 2.2.1 Cmsmadesimple CMS Made Simple 2.2.2 Cmsmadesimple CMS Made Simple 2.2.3 Cmsmadesimple CMS Made Simple 2.2.3.1 Cmsmadesimple CMS Made Simple 2.2.4 Cmsmadesimple CMS Made Simple 2.2.5 Cmsmadesimple CMS Made Simple 2.2.6 Cmsmadesimple CMS Made Simple 2.2.7 Cmsmadesimple CMS Made Simple 2.2.8	145

Common Weakness Enumeration (CWE)

CWE-502 - Deserialization of Untrusted Data

Metasploit

description	An issue was discovered in CMS Made Simple 2.2.8. In the module DesignManager (in the files action.admin_bulk_css.php and action.admin_bulk_template.php), with an unprivileged user with Designer permission, it is possible to reach an unserialize call with a crafted value in the m1_allparms parameter, and achieve object injection. This module has been successfully tested on CMS Made Simple versions 2.2.6, 2.2.7, 2.2.8, 2.2.9 and 2.2.9.1.
id	MSF:EXPLOIT/MULTI/HTTP/CMSMS_OBJECT_INJECTION_RCE
last seen	2020-06-14
modified	2019-11-13
published	2019-11-01
references	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9055 https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum
reporter	Rapid7
source	https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/multi/http/cmsms_object_injection_rce.rb
title	CMS Made Simple Authenticated RCE via object injection

Packetstorm

data source	https://packetstormsecurity.com/files/download/155322/cmsms_object_injection_rce.rb.txt
id	PACKETSTORM:155322
last seen	2019-11-14
published	2019-11-13
reporter	Daniele Scanu
source	https://packetstormsecurity.com/files/155322/CMS-Made-Simple-2.2.8-Remote-Code-Execution.html
title	CMS Made Simple 2.2.8 Remote Code Execution

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Metasploit

Packetstorm

References