=============================================================================================================================================
| # Title : GetSimple CMS 3.3.16 CSRF Delete all backups without user confirmation |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.2 (64 bits) |
| # Vendor : https://github.com/GetSimpleCMS/GetSimpleCMS |
=============================================================================================================================================
[+] References : https://packetstorm.news/files/id/190425/ & CVE-2021-28976
[+] Summary : GetSimple CMS 3.3.16 contains critical security vulnerabilities in its backup management system that allow attackers
to delete all backups, steal admin sessions, and access server files. These flaws require immediate patching.
[+] Vulnerable Code:
backups.php - Line ~34
if (isset($_GET['deleteall'])){
check_for_csrf("deleteall"); // CSRF check exists BUT...
// Immediately deletes ALL files without user confirmation
$filenames = getFiles($path);
foreach ($filenames as $file) {
delete_file($path . $file); // Mass deletion
}
}
[+] POC : poc.html
Special Offer
Limited Time Offer!
Click below to claim your discount:
Claim 50% Discount
---------------------
تحديث النظام
جاري تحديث النظام...
Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================