CVE-2021-47830
📋 TL;DR
CVE-2021-47830 is a CSRF vulnerability in GetSimple CMS My SMTP Contact Plugin 1.1.1 that allows attackers to trick authenticated administrators into changing SMTP configuration settings via malicious webpages. This affects administrators of websites using this specific plugin version. The vulnerability enables unauthorized configuration changes but doesn't directly lead to remote code execution.
💻 Affected Systems
- GetSimple CMS My SMTP Contact Plugin
📦 What is this software?
Getsimplecms by Get Simple
⚠️ Risk & Real-World Impact
Worst Case
Attackers could redirect all contact form emails to malicious addresses, intercept sensitive communications, or disable email functionality entirely, potentially leading to data leakage or service disruption.
Likely Case
Attackers change SMTP settings to intercept contact form submissions, potentially capturing sensitive user information or redirecting legitimate communications.
If Mitigated
With proper CSRF protections and administrator awareness, the attack would fail, leaving SMTP configuration unchanged.
🎯 Exploit Status
Exploitation requires social engineering to get authenticated administrators to visit malicious pages. Multiple public exploit examples exist.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.2 or later
Vendor Advisory: http://get-simple.info
Restart Required: No
Instructions:
1. Update GetSimple CMS My SMTP Contact Plugin to version 1.1.2 or later. 2. Verify the update was successful by checking the plugin version in the admin panel.
🔧 Temporary Workarounds
Implement CSRF Tokens
allAdd CSRF protection tokens to the SMTP configuration form manually if unable to update immediately.
Restrict Admin Access
allLimit administrator access to trusted networks only and implement strict access controls.
🧯 If You Can't Patch
- Disable the My SMTP Contact Plugin entirely and use alternative contact form solutions.
- Implement web application firewall rules to detect and block CSRF attempts targeting the SMTP configuration endpoint.
🔍 How to Verify
Check if Vulnerable:
Check the plugin version in GetSimple CMS admin panel under Plugins > My SMTP Contact. If version is 1.1.1, the system is vulnerable.Check Version:
Check via GetSimple CMS admin interface: Plugins > My SMTP ContactVerify Fix Applied:
After updating, verify the plugin version shows 1.1.2 or later in the admin panel and test that CSRF tokens are present in SMTP configuration form requests.📡 Detection & Monitoring
Log Indicators:
- Unexpected SMTP configuration changes in admin logs
- Multiple failed configuration attempts from unusual IP addresses
Network Indicators:
- POST requests to SMTP configuration endpoint without proper referrer headers or CSRF tokens
- Unusual traffic patterns to admin configuration pages
SIEM Query:
source="webserver" AND (uri="/admin/load.php?id=my_smtp_contact" OR uri CONTAINS "my_smtp_contact") AND method="POST"