CMSimple 3.1 - Local File Inclusion

A directory traversal vulnerability in cmsimple/cms.php in CMSimple 3.1 allows remote attackers to include and execute arbitrary local files via a dot dot(..) in the sl parameter to index.php when register globals are enabled. By including adm.php and then invoking the upload action, this can be utilised for remote file execution.

Mitigation / Precaution

The vendor patched 3.1 without changing the version number.

Written by

Anandhu K A

Lead Engineer

With a profound understanding of product development, Anandhu plays a pivotal role in crafting cutting-edge solutions that cater to the evolving security needs of digital applications. His expertise, deeply rooted in both engineering and security, makes him an essential component of Beagle Security's mission