CMSimple_XH Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in CMSimple_XH version 1.7.4. This issue arises in the content editing feature, where authenticated administrative users can upload malicious PHP files. Exploitation involves bypassing the CSRF token mechanism to create a PHP shell that allows arbitrary command execution on the server.

Impact

Exploitation of this vulnerability allows authenticated users to execute arbitrary commands on the server, potentially leading to full server compromise.

Reproduction

To reproduce this vulnerability, log into a CMSimple_XH 1.7.4 site as an administrator. Navigate to the content editing section and upload a PHP file containing a payload that exploits the vulnerability. The CSRF token mechanism can be bypassed to facilitate this process. Once the file is uploaded, it can be accessed and executed, leading to remote code execution on the server.