Unknown · Free Simple Cms · CVE-2010-3307
**Name of the Vulnerable Software and Affected Versions**
Free Simple CMS versions 1.0 and earlier
**Description**
The issue allows remote attackers to execute arbitrary PHP code via a URL in the `body`, `footer`, `header`, `menu left`, or `menu right` parameter. This can be achieved by exploiting remote file inclusion vulnerabilities in the themes/default/index.php file.
**Recommendations**
For Free Simple CMS versions 1.0 and earlier, as a temporary workaround, consider restricting access to the themes/default/index.php file and avoid using the parameters `body`, `footer`, `header`, `menu left`, or `menu right` in URLs until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.