GetSimple CMS hat CSRF zu Remote Code Execution via Arbitrary PHP Write in gsconfig.php

The impact of CVE-2026-28495 is severe. Successful exploitation allows an attacker to execute arbitrary PHP code on the web server hosting the GetSimple CMS instance. This can lead to complete system compromise, including data exfiltration, malware installation, and denial of service. Given the ability to modify the gsconfig.php file, an attacker can effectively control the CMS's configuration and potentially gain access to sensitive data or modify website content. The CSRF aspect means an attacker only needs to trick a logged-in administrator into visiting a malicious page, significantly lowering the barrier to exploitation.

Websites using GetSimpleCMS-CE versions 3.3.22 and earlier, particularly those with multiple administrators or shared hosting environments, are at significant risk. Administrators who routinely use the gsconfig editor module are especially vulnerable to CSRF attacks.

• php: Examine gsconfig.php for unexpected or malicious PHP code.

find /var/www/html -name gsconfig.php -print0 | xargs -0 grep -i 'eval(' 

• generic web: Monitor access logs for requests to the gsconfig editor module originating from unusual IP addresses or user agents.

grep "/admin/gsconfig.php" access.log

• generic web: Check response headers for signs of code execution or unexpected behavior after accessing the gsconfig editor module.

curl -I http://your-website.com/admin/gsconfig.php

1. 2026-03-10Disclosure

   disclosure

1. Reserviert2026-02-27
2. Veröffentlicht2026-03-10
3. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-28495 is to upgrade to a patched version of GetSimpleCMS-CE that includes a fixed version of the massiveAdmin plugin. Unfortunately, a specific fixed version is not provided. As a temporary workaround, consider implementing strict input validation and sanitization on all user-supplied data within the gsconfig editor module. Additionally, implement robust CSRF protection across all administrative interfaces within GetSimple CMS. Web Application Firewalls (WAFs) configured to detect and block malicious PHP code injection attempts can also provide a layer of defense. After upgrading, confirm the vulnerability is resolved by attempting to access the gsconfig editor module as an administrator and verifying that any attempts to modify the gsconfig.php file are blocked.