CWE Code: 74
Vulnerability Type: privilege_escalation
CVSS Score: 6.5
CWE Name:  Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Summary: an issue was discovered in cms made simple 2.2.8. in the module designmanager (in the files action.admin_bulk_css.php and action.admin_bulk_template.php), with an unprivileged user with designer permission, it is possible reach an unserialize call with a crafted value in the m1_allparms parameter, and achieve object injection.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2019-03-26
Last Modified Date: 2019-03-27