September 14, 2018

Local file inclusion in cmsmadesimple <=2.2.1


The File Inclusion vulnerability allows an attacker to include a file, usually exploiting a "dynamic file inclusion" mechanisms implemented in the target application. The vulnerability occurs due to the use of user-supplied input without proper validation.

The PoC:

The Vulnerability is existing in /cmsms/admin/listtags.php Line 82 and line 54

If there is a file named "1.phpinfo.php" in

So when we visit the following link:

local file inclusion successfully!

Current version is still vulnerable.

Disclosure Timeline

2017/2/7 Provide vulnerability(2.1.6) detail to vendor but no reply

2017/6/16 cmsmadesimple update to 2.2.1 and no reply at all

2017/6/28 Public disclosure