CMSimple Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in CMSimple version 5.4. This vulnerability allows authenticated attackers to inject malicious PHP code into template files. Exploitation involves using the template editing feature to save a crafted payload, such as a reverse shell, through the template editing endpoint, accompanied by a valid CSRF token.

Impact

Exploitation of this vulnerability allows for authenticated remote code execution on the server where CMSimple is hosted.

Reproduction

To reproduce this vulnerability, log into a CMSimple 5.4 site as a user with template editing permissions. Navigate to the template editing section and inject a PHP payload into the template file. This payload can be a reverse shell, for example. Save the changes, and the injected code will be executed on the server.