CVE-2017-8081
HighSummary
Poor cryptographic salt initialization in admin/inc/template_functions.php in GetSimple CMS 3.3.13 allows a network attacker to escalate privileges to an arbitrary user or conduct CSRF attacks via calculation of a session cookie or CSRF nonce.
Risk Assessment
The organization may be exposed to unauthorized access to user accounts and CSRF attacks, potentially leading to serious security breaches.
Recommendation
It is recommended to update GetSimple CMS to the latest version to mitigate this vulnerability and implement additional security measures such as monitoring user sessions.
Other vulnerabilities in GetSimple CMS 3.3.13
See all- CVE-2014-8722High
GetSimple CMS version 3.3.4 allows remote attackers to obtain sensitive information via direct requests to specific XML files.
- CVE-2026-53952Critical
GetSimple CMS (v3.4.0a and below) and GetSimple CMS CE (v3.3.22 and below) contain a logic flaw allowing unauthenticated attackers to create a new administrator account. The automated control that deletes admin/setup.php after installation is neutralized by a self-exclusion bug, leaving the setup script accessible. As of publication, no patched versions are available.
Original NVD description (English source)
Poor cryptographic salt initialization in admin/inc/template_functions.php in GetSimple CMS 3.3.13 allows a network attacker to escalate privileges to an arbitrary user or conduct CSRF attacks via calculation of a session cookie or CSRF nonce.