Description
GetSimple CMS Custom JS 0.1 plugin contains a cross-site request forgery vulnerability that allows unauthenticated attackers to inject arbitrary client-side code into administrator browsers. Attackers can craft a malicious website that triggers a cross-site scripting payload to execute remote code on the hosting server when an authenticated administrator visits the page.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GetSimple CMS | Custom JS Plugin | 0.1 | — |
References
- ExploitDB-49816 exploit
- Vendor Homepage product
- GetSimple CMS GitHub Repository product
- Researcher Disclosure technical-description exploit
- ExploitDB-49712 exploit
- VulnCheck Advisory: GetSimple CMS Custom JS 0.1 - CSRF to XSS to RCE third-party-advisory