CVE-2024-27622: CMS Made Simple RCE Vulnerability

CVE-2024-27622 Overview

CVE-2024-27622 is an authenticated remote code execution vulnerability affecting CMS Made Simple (CMSMS) versions 2.2.19 and 2.2.21. The flaw resides in the User Defined Tags (UDT) module, where the Code input field fails to sanitize user-supplied PHP content. Administrators can inject arbitrary PHP code that the application evaluates server-side, granting full command execution in the web server context. The issue is classified under CWE-75: Failure to Sanitize Special Elements into a Different Plane. Public technical write-ups and proof-of-concept material exist on Packet Storm and third-party research blogs.

Critical Impact
An authenticated administrator can execute arbitrary PHP on the underlying host, leading to full compromise of the CMS Made Simple installation and hosting environment.

Affected Products

CMS Made Simple 2.2.19
CMS Made Simple 2.2.21
Deployments exposing the User Defined Tags administrative module

Discovery Timeline

2024-03-05 - CVE-2024-27622 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-27622

Vulnerability Analysis

CMS Made Simple exposes the User Defined Tags module in its administrator console. This module lets privileged users create reusable PHP snippets referenced from templates and pages. The submitted Code field is stored and later evaluated by the PHP interpreter without sanitization or sandboxing. Any authenticated user assigned the UDT management permission can therefore write arbitrary PHP that executes with the privileges of the web server process. Because the code runs inside the application runtime, attackers gain immediate access to database credentials, filesystem contents, and outbound network capability. The vulnerability requires high privileges but no user interaction, and it can be exploited remotely once administrative credentials are obtained through phishing, credential reuse, or a chained lower-severity flaw.

Root Cause

The UDT feature treats administrator-supplied input as trusted PHP source. The application persists the Code field and later passes it to a PHP execution primitive without validation, allow-listing, or bytecode restrictions. There is no separation between configuration data and executable code.

Attack Vector

An attacker with administrator access authenticates to the CMSMS admin console, navigates to Extensions → User Defined Tags, and creates or edits a tag. The attacker places malicious PHP inside the Code field, such as a call that shells out via system() or reads sensitive files. Saving the tag or triggering its execution runs the payload on the server. Further technical detail is documented in the Packet Storm advisory and the Vicarius research write-up.

// No verified exploit code is reproduced here.
// Refer to the linked Packet Storm advisory for the published proof of concept.

Detection Methods for CVE-2024-27622

Indicators of Compromise

New or modified rows in the CMSMS cms_userplugins table containing PHP functions such as system, exec, passthru, shell_exec, eval, or base64_decode.
Web server child processes (php-fpm, apache2, httpd) spawning shell interpreters (sh, bash, cmd.exe) or reconnaissance binaries such as whoami, id, or curl.
Outbound network connections initiated by the PHP worker to unexpected hosts shortly after admin/adduserplugin.php or admin/edituserplugin.php requests.
Unexpected files written under the CMSMS uploads/ or tmp/ directories following UDT edits.

Detection Strategies

Audit HTTP access logs for POST requests to admin/adduserplugin.php and admin/edituserplugin.php correlated with administrative session identifiers.
Alert on process-lineage patterns where the web server user launches command interpreters or network utilities, a strong signal of PHP-based RCE.
Deploy file integrity monitoring on the CMSMS webroot and database backup of the cms_userplugins table to catch unauthorized tag additions.

Monitoring Recommendations

Forward web, PHP, and process telemetry to a central analytics platform and retain administrator session activity for at least 90 days.
Enable PHP disable_functions logging where feasible to record blocked calls originating from UDT execution.
Monitor authentication logs for successful administrator logins from new IP addresses or user agents, since exploitation requires administrator credentials.

How to Mitigate CVE-2024-27622

Immediate Actions Required

Upgrade CMS Made Simple to a version released after 2.2.21 that addresses the UDT sanitization issue, per vendor guidance in the CMS Made Simple project repository.
Rotate all administrator credentials and invalidate active admin sessions on affected installations.
Review the cms_userplugins table and remove any UDT entries that were not created by authorized personnel.
Restrict administrator console access to trusted IP ranges via web server ACLs or a VPN.

Patch Information

Upgrade to the latest CMS Made Simple release that includes hardened UDT handling. Consult the vendor project page and release notes referenced in the Vicarius analysis of CVE-2024-27622 for version-specific remediation guidance. Verify the patch by confirming that PHP code entered into the Code field is either blocked or executed under an allow-list.

Workarounds

Remove the User Defined Tags management permission from all non-essential administrator accounts.
Enforce multi-factor authentication on every administrator login to reduce the risk of credential-based access.
Configure PHP disable_functions to block dangerous primitives such as system, exec, passthru, shell_exec, and proc_open on servers hosting CMSMS.
Place the CMSMS admin interface behind a reverse proxy that enforces network segmentation and request-level authentication.

bash

# Example PHP hardening for servers hosting CMS Made Simple
# /etc/php/8.2/fpm/php.ini
disable_functions = system,exec,passthru,shell_exec,proc_open,popen,eval
allow_url_include = Off
allow_url_fopen = Off

# Restrict access to the admin path at the web server layer (nginx example)
# location /admin/ {
#     allow 10.0.0.0/24;
#     deny all;
# }