CVE-2020-17462
📋 TL;DR
CMS Made Simple 2.2.14 allows authenticated users to upload malicious .ptar files through the File Manager, potentially leading to arbitrary code execution. This affects all installations running the vulnerable version with authenticated user accounts. The vulnerability is similar to CVE-2017-16798 but targets a different file extension.
💻 Affected Systems
- CMS Made Simple
📦 What is this software?
Cms Made Simple by Cmsmadesimple
⚠️ Risk & Real-World Impact
Worst Case
An authenticated attacker uploads a malicious .ptar file containing PHP code, gains remote code execution, and takes full control of the web server.
Likely Case
Authenticated users with file upload privileges upload webshells or malware to compromise the CMS installation.
If Mitigated
With proper file extension filtering and user privilege restrictions, impact is limited to file system access within upload directories.
🎯 Exploit Status
Exploit requires authenticated access to the CMS admin panel. Public exploit code is available on Exploit-DB.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.2.15 or later
Vendor Advisory: https://forum.cmsmadesimple.org/viewtopic.php?f=1&t=83485
Restart Required: No
Instructions:
1. Backup your CMS installation and database. 2. Download CMS Made Simple 2.2.15 or later from the official website. 3. Replace all files except uploads and config.php. 4. Run the upgrade script if prompted. 5. Verify the installation works correctly.
🔧 Temporary Workarounds
Block .ptar file uploads via .htaccess
linuxAdd .ptar to blocked file extensions in Apache configuration
<FilesMatch "\.ptar$">
Order Allow,Deny
Deny from all
</FilesMatch>
Restrict file upload permissions
allRemove file upload permissions from non-admin users in CMS admin panel
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block .ptar file uploads
- Disable file upload functionality entirely for all users
🔍 How to Verify
Check if Vulnerable:
Check CMS version in admin panel or look for version in /admin/login.php source codeCheck Version:
Check admin panel dashboard or view source of login page for version stringVerify Fix Applied:
After patching, attempt to upload a .ptar file through the File Manager - it should be rejected📡 Detection & Monitoring
Log Indicators:
- File upload attempts with .ptar extension in web server logs
- Unauthorized file creation in upload directories
Network Indicators:
- POST requests to file upload endpoints with .ptar files
- Unusual outbound connections from web server
SIEM Query:
source="web_logs" AND (uri_path="*admin*" OR uri_path="*upload*") AND file_extension=".ptar"