CVE-2024-27623

Published: Mar 5, 2024Modified: Jun 17, 2026

5.9

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Exploitability: 1.7 / Impact: 3.7

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

CMS Made Simple version 2.2.19 is vulnerable to Server-Side Template Injection (SSTI). The vulnerability exists within the Design Manager, particularly when editing the Breadcrumbs.

Affected (1)

Products: Cmsmadesimple: Cms Made Simple

Cmsmadesimple

1 product

Cms Made Simple

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Cmsmadesimple Cms Made Simple	Version 2.2.19

Related CWEs

CWE-1336

Improper Neutralization of Special Elements Used in a Template Engine

The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

References (3)

https://github.com/capture0x/CMSMadeSimple2

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/capture0x/CMSMadeSimple2

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://www.vicarius.io/vsociety/posts/pwning-cmsms-via-user-defined-tags-for-fun-and-learning-cve-2024-27622-27623

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.