Unscored severity · published May 16, 2008
CVE-2008-2267
Incomplete blacklist vulnerability in javaUpload.php in Postlet in the FileManager module in CMS Made Simple 1.2.4 and earlier allows remote attackers to execute arbitrary code by…
–
CVSS
4.8%
EPSS
No
On KEV
Description
Incomplete blacklist vulnerability in javaUpload.php in Postlet in the FileManager module in CMS Made Simple 1.2.4 and earlier allows remote attackers to execute arbitrary code by uploading a file with a name ending in (1) .jsp, (2) .php3, (3) .cgi, (4) .dhtml, (5) .phtml, (6) .php5, or (7) .jar, then accessing it via a direct request to the file in modules/FileManager/postlet/.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.8% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CM
Cms Made Simple · Cms Made Simple
1.2.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-2267
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-2267
blog.cmsmadesimple.org
http://blog.cmsmadesimple.org/2008/05/12/announcing-cms-made-simple-125/
Vendor Advisory
http://secunia.com/advisories/30208
www.attrition.org
http://www.attrition.org/pipermail/vim/2008-May/001978.html
Exploit
http://www.securityfocus.com/bid/29170
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/42371
www.exploit-db.com
https://www.exploit-db.com/exploits/5600
More from Cms Made Simple
8.8
CVE-2024-1527
Unrestricted Upload of File with Dangerous Type in CMS Made Simple
6.1
CVE-2024-1529
Cross-site Scripting in CMS Made Simple
6.1
CVE-2024-1528
Cross-site Scripting in CMS Made Simple
4.7
CVE-2026-5203
CMS Made Simple UserGuide Module XML Import class.UserGuideImporterExporter.php _copyFilesToFolder path traversal
2.4
CVE-2026-4225
CMS Made Simple User Management listusers.php cross site scripting