CVE-2021-47778
📋 TL;DR
CVE-2021-47778 is a PHP code injection vulnerability in GetSimple CMS My SMTP Contact Plugin 1.1.2 that allows authenticated administrators to execute arbitrary code on the server through plugin configuration parameters. This affects all GetSimple CMS installations using the vulnerable plugin version. Successful exploitation leads to complete server compromise.
💻 Affected Systems
- GetSimple CMS My SMTP Contact Plugin
📦 What is this software?
Getsimplecms by Get Simple
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise with attacker gaining persistent access, data exfiltration, lateral movement to other systems, and deployment of ransomware or other malware.
Likely Case
Attacker gains shell access to the web server, can read/write files, access databases, and potentially pivot to other systems on the network.
If Mitigated
Limited impact if proper network segmentation, file integrity monitoring, and least privilege principles are implemented.
🎯 Exploit Status
Exploit code is publicly available on Exploit-DB and GitHub. Requires administrator credentials to access the plugin configuration page.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: N/A
Restart Required: No
Instructions:
1. Remove or disable the My SMTP Contact Plugin 1.1.2. 2. Consider migrating to alternative SMTP plugins or contact form solutions. 3. Update GetSimple CMS to latest version if available.
🔧 Temporary Workarounds
Disable vulnerable plugin
linuxRemove or disable the My SMTP Contact Plugin 1.1.2 from GetSimple CMS installation
rm -rf /path/to/getsimple/plugins/my-smtp-contact/
Restrict admin access
allImplement IP whitelisting for admin panel access and enforce strong authentication
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the GetSimple CMS server
- Deploy web application firewall with PHP injection detection rules
🔍 How to Verify
Check if Vulnerable:
Check if /plugins/my-smtp-contact/ directory exists and contains version 1.1.2 filesCheck Version:
cat /path/to/getsimple/plugins/my-smtp-contact/plugin.xml | grep 'version'Verify Fix Applied:
Confirm the my-smtp-contact plugin directory no longer exists or has been replaced with secure version📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to plugin configuration pages
- PHP execution errors in web server logs
- File creation/modification in web directories
Network Indicators:
- Outbound connections from web server to unexpected destinations
- Unusual traffic patterns from admin IP addresses
SIEM Query:
source="web_logs" AND (uri="/admin/load.php" OR uri="/admin/plugin.php") AND (params CONTAINS "eval(" OR params CONTAINS "system(" OR params CONTAINS "exec(")