Executive brief
CMSimple is a flat-file PHP content management system widely used for small websites and intranets. The product ships with CSRF protection disabled by default, allowing an unauthenticated attacker to forge requests that trick a logged-in administrator into saving malicious code. This code is executed on every page view by all visitors, resulting in persistent remote code execution on the web server.
Technical details
The vulnerability chains three defects: CSRF protection is disabled by default (defaultconfig.php sets csrf_protection to empty string instead of 'true'), admin forms do not emit CSRF tokens, and the content-save endpoint does not enforce token validation. An unauthenticated attacker can induce a logged-in admin's browser to submit a forged POST/GET to adm.php with function='save', embedding a #CMSimple...# scripting marker in the text payload. The marker is stored verbatim in content/content.php and executed by evaluate_cmsimple_scripting() via eval() on every page render, for all visitors including unauthenticated ones, yielding persistent RCE.
Affected products
- ge-webdesign CMSimple 5.24
Timeline
- 2026-09-22: disclosed