H4Ckr4V3N

Name of the Vulnerable Software and Affected Versions: Redaxo CMS version 5.17.1 Description: An arbitrary file upload vulnerability in the MediaPool module of Redaxo CMS allows attackers to execute arbitrary code via uploading a crafted file. Recommendations: For Redaxo CMS version 5.17.1, consider disabling the MediaPool module until a patch is available to prevent arbitrary code execution. Restrict access to the file upload functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** REDAXO CMS version 5.17.1 **Description** A stored cross-site scripting (XSS) vulnerability in the component /media/test.html of REDAXO CMS allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the `password` parameter. **Recommendations** As a temporary workaround, consider disabling access to the /media/test.html component until a patch is available. Restrict the ability to inject crafted payloads into the `password` parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CMSimple version 5.16 **Description** The issue in CMSimple is related to insufficient protection of internal data in the link validation function. This can be exploited by a remote attacker to obtain sensitive information via a crafted script. The vulnerability may also allow an attacker to perform a Server-Side Request Forgery (SSRF) attack. **Recommendations** For CMSimple version 5.16, consider disabling the validate link function as a temporary workaround until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CMSimple version 5.16 **Description** The issue is related to insecure permissions in the file download functionality of the backup system, allowing a remote attacker to obtain sensitive information. This can be achieved through a crafted script that manipulates the download functionality of php backup files. The vulnerability is associated with incorrect permission assignment for a critical resource, which can enable an attacker to gain unauthorized access to protected information and execute arbitrary code. **Recommendations** For CMSimple version 5.16, consider disabling the backup file download functionality until a patch is available to prevent exploitation. Restrict access to critical resources to minimize the risk of unauthorized information disclosure. Avoid using the vulnerable functionality to download php backup files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CMSimple version 5.16 **Description** The issue is related to incorrect restriction of a directory path with limited access. Exploitation may allow a remote attacker to gain unauthorized access to protected information by sending a specially crafted GET request. The vulnerability also allows a user to edit the `log.php` file via the print page. **Recommendations** For CMSimple version 5.16, consider restricting access to the print page to prevent unauthorized editing of the `log.php` file until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CMSimple version 5.16 **Description** The issue allows a user to read the CMS source code by manipulating the file name in the file parameter of a GET request. This is due to incorrect restriction of the path name to a directory with limited access. An attacker can exploit this to gain unauthorized access to protected information by sending a specially crafted GET request. **Recommendations** For CMSimple version 5.16, as a temporary workaround, consider restricting access to the file parameter in GET requests until a patch is available. Avoid using the `file` parameter in affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.