Is CVE-2016-7904 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-7904 being exploited in the wild.

How severe is CVE-2016-7904?

High severity, with a CVSS score of 8, published 16 January 2017.

Which products and versions are affected?

CMS Made Simple CMS Made Simple before 2.1.6.

Is there a fix for CVE-2016-7904?

A patch was published on 2016-12-01: Fixed in version 2.1.6 (Spanish Wells) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-7904 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2016-7904?

Check whether you run Cmsmadesimple Cms Made Simple. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-7904: CMS Made Simple CSRF in admin/adduser.php

CVE-2016-7904 · Severity: high · CVSS 8 · Published 2017-01-16

CMS Made Simple, a popular open-source content management system, contains a security flaw that could allow an attacker to trick an administrator into performing unauthorized actions. By convincing a logged-in administrator to visit a malicious link, an attacker can hijack their session to create new administrative accounts. This could lead to a full takeover of the website, allowing the attacker to modify content or access sensitive data.

Technologies: Cmsmadesimple Cms Made Simple. Vendors: Cmsmadesimple.

Quick answers

Is CVE-2016-7904 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-7904 being exploited in the wild.
How severe is CVE-2016-7904?: High severity, with a CVSS score of 8, published 16 January 2017.
Which products and versions are affected?: CMS Made Simple CMS Made Simple before 2.1.6.
Is there a fix for CVE-2016-7904?: A patch was published on 2016-12-01: Fixed in version 2.1.6 (Spanish Wells) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-7904 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2016-7904?: Check whether you run Cmsmadesimple Cms Made Simple. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in CMS Made Simple versions prior to 2.1.6. The flaw is located in the 'admin/adduser.php' component, where the application fails to properly validate CSRF tokens or protect against token leakage via the Referer header. An attacker can exploit this by inducing an authenticated administrator to visit a malicious page (e.g., via a linked image in an article), which captures the administrator's session token and submits a forged request to create a new administrative user. This allows for privilege escalation and full site compromise. The issue was addressed in version 2.1.6 by improving CSRF token handling and setting meta referrer attributes.

Affected products

CMS Made Simple CMS Made Simple before 2.1.6

Timeline

2016-10-04: disclosed: Vulnerability discovered and reported by Hongkun Zeng
2017-01-16: advisory: Public disclosure and NVD publication
2016-12-01: patched: Fixed in version 2.1.6 (Spanish Wells)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.