CVE-2018-7448 PoC — CMS Made Simple 安全漏洞

Source

https://github.com/b1d0ws/exploit-cve-2018-7448

Associated Vulnerability

Title:CMS Made Simple 安全漏洞 (CVE-2018-7448)
Description:Remote code execution vulnerability in /cmsms-2.1.6-install.php/index.php in CMS Made Simple version 2.1.6 allows remote attackers to inject arbitrary PHP code via the "timezone" parameter in step 4 of a fresh installation procedure.

Description

Python script for CMS Made Simple 2.1.6 - Remote Code Execution.

Readme

# exploit-cve-2018-7448

### Purpose
This is a python script to automate CMS Made Simple 2.1.6 - Remote Code Execution - CVE-2018-7448.

It was created based on https://www.exploit-db.com/exploits/44192.

### Usage
```bash
python3 exploit-CVE-2018-7448.py -t 127.0.0.1/cmsms -d cms -u root -p password
```

### Troubleshooting
If the installer is different from `cmsms-2.1.6-install.php`, you will have to change the file name in the code.

The exploit works on HTTP by default, if you need to exploit HTTPS, change the URLs in the code.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!