Executive brief
CMS Made Simple, a popular open-source content management system, contains a security flaw that could allow an attacker to trick an administrator into performing unauthorized actions. By convincing a logged-in administrator to visit a malicious link, an attacker can hijack their session to create new administrative accounts. This could lead to a full takeover of the website, allowing the attacker to modify content or access sensitive data.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in CMS Made Simple versions prior to 2.1.6. The flaw is located in the 'admin/adduser.php' component, where the application fails to properly validate CSRF tokens or protect against token leakage via the Referer header. An attacker can exploit this by inducing an authenticated administrator to visit a malicious page (e.g., via a linked image in an article), which captures the administrator's session token and submits a forged request to create a new administrative user. This allows for privilege escalation and full site compromise. The issue was addressed in version 2.1.6 by improving CSRF token handling and setting meta referrer attributes.
Affected products
- CMS Made Simple CMS Made Simple before 2.1.6
Timeline
- 2016-10-04: disclosed: Vulnerability discovered and reported by Hongkun Zeng
- 2017-01-16: advisory: Public disclosure and NVD publication
- 2016-12-01: patched: Fixed in version 2.1.6 (Spanish Wells)