Platform
php
Component
my-smtp-contact-plugin
Fixed in
1.1.3
CVE-2021-47778 describes a PHP code injection vulnerability found in My SMTP Contact Plugin for GetSimple CMS. An authenticated administrator can exploit this flaw to inject and execute arbitrary PHP code, granting them significant control over the affected server. This vulnerability impacts versions 1.1.2 through 1.1.2, and a fix is pending.
The impact of CVE-2021-47778 is severe. Successful exploitation allows an authenticated administrator to execute arbitrary PHP code on the server hosting the GetSimple CMS instance. This could lead to complete system compromise, including data theft, modification, or deletion. An attacker could install malware, create backdoors, or pivot to other systems on the network. The ability to inject code directly into the server's execution path makes this a high-risk vulnerability, potentially enabling a wide range of malicious activities.
As of the publication date, there is no public proof-of-concept (POC) code available for CVE-2021-47778. The vulnerability's severity and the potential for remote code execution suggest a medium probability of exploitation. It is not currently listed on the CISA KEV catalog. Active campaigns targeting this specific vulnerability are not known, but the ease of exploitation could make it an attractive target for malicious actors.
Exploit Status
EPSS
1.07% (78% percentile)
CISA SSVC
Given the lack of a currently available patch, immediate mitigation steps are crucial. Restrict administrator access to the plugin configuration as much as possible. Implement strict input validation on all plugin configuration parameters to prevent malicious code injection. Consider temporarily disabling the plugin if feasible. Web application firewalls (WAFs) configured to detect and block PHP code injection attempts can provide an additional layer of defense. Monitor server logs for suspicious activity, particularly attempts to access or modify plugin configuration files.
Update the My SMTP Contact Plugin to a patched version. Check the developer's website or the GetSimple CMS repository for the latest available version. As an additional security measure, consider disabling or removing the plugin until it can be updated.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2021-47778 is a vulnerability in My SMTP Contact Plugin for GetSimple CMS allowing authenticated administrators to inject and execute arbitrary PHP code, potentially leading to server compromise.
You are affected if you are using My SMTP Contact Plugin for GetSimple CMS versions 1.1.2–1.1.2 and have not upgraded to a patched version (currently unavailable).
A patch is currently unavailable. Mitigate by restricting administrator access, validating plugin input, and monitoring server logs.
Active exploitation is not currently known, but the vulnerability's severity makes it a potential target.
Refer to the GetSimple CMS website and security advisories for updates and information regarding CVE-2021-47778.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.