{"uuid": "c7010e02-79e4-4c9e-b97a-c5e930210515", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-36969", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/cmsms_file_manager_auth_rce.rb", "content": "{\"aliases\": [], \"arch\": \"php\", \"author\": [\"Okan Kurtulu\\u015f\", \"Mirabbas A\\u011falarov\", \"tastyrice\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"CMS Made Simple <= v2.2.21 allows an authenticated administrator to upload files\\n          with the .phar or .phtml extensions, enabling execution of PHP code\\n          leading to RCE. The file can be executed by accessing its URL in the\\n          /uploads/ directory.\\n\\n          Tested on v2.2.21, v2.2.18, v2.2.17, v2.2.16, v2.2.15, v2.2.14.\", \"disclosure_date\": \"2023-06-07\", \"fullname\": \"exploit/multi/http/cmsms_file_manager_auth_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:57:58 +0000\", \"name\": \"CmsMadeSimple Authenticated File Manager RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/cmsms_file_manager_auth_rce.rb\", \"platform\": \"PHP\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"multi/http/cmsms_file_manager_auth_rce\", \"references\": [\"CVE-2023-36969\", \"EDB-51600\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Universal\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:44.738113Z"}