CVE-2020-23839

EPSS 10.5%

A Reflected Cross-Site Scripting (XSS) vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpage, allows remote attackers to execute JavaScript code in the client's browser and harvest login credentials after a client clicks a link, enters credentials, and submits the login form.

Affected products

n/a · n/a

public PoCs found — 3

githubgithub.com/boku7/CVE-2020-23839★ 11 cve_referencepacketstormsecurity.com/files/162016/GetSimple-CMS-3.3.16-Cross-Site-Scripting-Shell-Upload.htmlunverified cve_referencewww.exploit-db.com/exploits/49726unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://packetstormsecurity.com/files/162016/GetSimple-CMS-3.3.16-Cross-Site-Scripting-Shell-Upload.html https://github.com/boku7/CVE-2020-23839 https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1330 https://www.exploit-db.com/exploits/49726