# CVE-2016-7904: CMS Made Simple CSRF in admin/adduser.php

Source: https://junglewise.ai/threats/cve-2016-7904-cms-made-simple-csrf-in-admin-adduser-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-16. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2016-7904 · Severity: high · CVSS 8 · Published 2017-01-16

CMS Made Simple, a popular open-source content management system, contains a security flaw that could allow an attacker to trick an administrator into performing unauthorized actions. By convincing a logged-in administrator to visit a malicious link, an attacker can hijack their session to create new administrative accounts. This could lead to a full takeover of the website, allowing the attacker to modify content or access sensitive data.

Technologies: [Cmsmadesimple Cms Made Simple](https://junglewise.ai/threats/technologies/cms-made-simple). Vendors: [Cmsmadesimple](https://junglewise.ai/threats/vendors/cmsmadesimple).

## Quick answers

**Is CVE-2016-7904 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-7904 being exploited in the wild.

**How severe is CVE-2016-7904?** High severity, with a CVSS score of 8, published 16 January 2017.

**Which products and versions are affected?** CMS Made Simple CMS Made Simple before 2.1.6.

**Is there a fix for CVE-2016-7904?** A patch was published on 2016-12-01: Fixed in version 2.1.6 (Spanish Wells) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2016-7904 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2016-7904?** Check whether you run Cmsmadesimple Cms Made Simple. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in CMS Made Simple versions prior to 2.1.6. The flaw is located in the 'admin/adduser.php' component, where the application fails to properly validate CSRF tokens or protect against token leakage via the Referer header. An attacker can exploit this by inducing an authenticated administrator to visit a malicious page (e.g., via a linked image in an article), which captures the administrator's session token and submits a forged request to create a new administrative user. This allows for privilege escalation and full site compromise. The issue was addressed in version 2.1.6 by improving CSRF token handling and setting meta referrer attributes.

## Affected products

- CMS Made Simple CMS Made Simple before 2.1.6

## Timeline

- 2016-10-04: disclosed: Vulnerability discovered and reported by Hongkun Zeng
- 2017-01-16: advisory: Public disclosure and NVD publication
- 2016-12-01: patched: Fixed in version 2.1.6 (Spanish Wells)

## References

- [http://dev.cmsmadesimple.org/project/changelog/5392](http://dev.cmsmadesimple.org/project/changelog/5392)
- [http://www.openwall.com/lists/oss-security/2017/01/16/1](http://www.openwall.com/lists/oss-security/2017/01/16/1)
- [http://www.securityfocus.com/bid/95453](http://www.securityfocus.com/bid/95453)