CVE-2021-47735
Published: 23 December 2025
Description
CMSimple 5.4 contains an authenticated remote code execution vulnerability that allows logged-in attackers to inject malicious PHP code into template files. Attackers can exploit the template editing functionality by crafting a reverse shell payload and saving it through the template…
more
editing endpoint with a valid CSRF token.
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the inadequate input validation in the template editing endpoint that enables PHP code injection.
Restricts access to template file modifications, preventing low-privilege authenticated users from injecting malicious code.
Mandates remediation of the specific code injection flaw in CMSimple's template editing functionality through patching.
Security SummaryAI
CVE-2021-47735 is an authenticated remote code execution vulnerability in CMSimple 5.4, classified under CWE-94 (Code Injection). It stems from inadequate input validation in the template editing functionality, enabling attackers to inject arbitrary PHP code into template files. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), highlighting its high severity due to network accessibility and potential for complete system compromise.
Logged-in users with low privileges can exploit this flaw by crafting a malicious PHP payload, such as a reverse shell, and submitting it via the template editing endpoint accompanied by a valid CSRF token. Successful exploitation grants remote code execution on the server, allowing attackers to execute arbitrary commands, potentially leading to full server control, data exfiltration, or further lateral movement within the environment.
Advisories from Vulncheck detail the authenticated RCE via template editing, while Exploit-DB provides a proof-of-concept exploit (ID 50356). Security practitioners should refer to the CMSimple.org website and these resources for any available patches, updates, or mitigation guidance, as no specific remediation details are outlined in the core vulnerability description.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Authenticated RCE via code injection in template editing of public-facing CMSimple CMS directly enables T1190 (Exploit Public-Facing Application) and T1221 (Template Injection).