{"uuid": "dbf50e11-5b53-4abb-93d7-be37168821ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-9692", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/cmsms_showtime2_rce.rb", "content": "{\"aliases\": [], \"arch\": \"php\", \"author\": [\"Daniele Scanu\", \"Fabio Cogno\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a File Upload vulnerability that lead in a RCE in\\n          Showtime2 module (<= 3.6.2) in CMS Made Simple (CMSMS). An authenticated\\n          user with \\\"Use Showtime2\\\" privilege could exploit the vulnerability.\\n\\n          The vulnerability exists in the Showtime2 module, where the class\\n          \\\"class.showtime2_image.php\\\" does not ensure that a watermark file\\n          has a standard image file extension (GIF, JPG, JPEG, or PNG).\\n\\n          Tested on Showtime2 3.6.2, 3.6.1, 3.6.0, 3.5.4, 3.5.3, 3.5.2, 3.5.1, 3.5.0,\\n          3.4.5, 3.4.3, 3.4.2 on CMS Made Simple (CMSMS) 2.2.9.1\", \"disclosure_date\": \"2019-03-11\", \"fullname\": \"exploit/multi/http/cmsms_showtime2_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:57:58 +0000\", \"name\": \"CMS Made Simple (CMSMS) Showtime2 File Upload RCE\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/multi/http/cmsms_showtime2_rce.rb\", \"platform\": \"PHP\", \"post_auth\": true, \"rank\": 300, \"ref_name\": \"multi/http/cmsms_showtime2_rce\", \"references\": [\"CVE-2019-9692\", \"CWE-434\", \"EDB-46546\", \"URL-https://forum.cmsmadesimple.org/viewtopic.php?f=1&t=80285\", \"URL-http://viewsvn.cmsmadesimple.org/diff.php?repname=showtime2&path=%2Ftrunk%2Flib%2Fclass.showtime2_image.php&rev=47\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Automatic\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:44.894817Z"}