CVE-2026-88418: CSRF

Описание

Оригинално описание

CMSimple 5.24 ships with CSRF protection disabled by default, which turns csrfProtection() into a no-op on every state-changing admin request, and it does not send the csrf_token hidden field in admin forms. Because administrator authentication is cookie-only and no CSRF token is enforced, an unauthenticated attacker can induce a logged-in administrator's browser to issue a forged content-save request with a text payload containing a scripting marker. The marker is stored verbatim into content/content.php; on every subsequent page view evaluate_cmsimple_scripting() (functions.php) executes the marker body with PHP eval() — for all visitors, including unauthenticated ones. This yields persistent remote code execution on the web server.

Засегнати продукти

• n/a n/a: n/a

Вид слабост

• CWE-352 CSRF

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-88418
• https://nvd.nist.gov/vuln/detail/CVE-2026-88418
• https://github.com/15536818056/CVE/issues/5