CVE-2021-47870
📋 TL;DR
This stored XSS vulnerability in GetSimple CMS My SMTP Contact Plugin allows attackers to inject malicious JavaScript that executes in administrators' browsers. Attackers can bypass the plugin's htmlspecialchars() sanitization using hex-encoded characters. All administrators using the vulnerable plugin version are affected.
💻 Affected Systems
- GetSimple CMS My SMTP Contact Plugin
📦 What is this software?
Getsimplecms by Get Simple
⚠️ Risk & Real-World Impact
Worst Case
Administrator account compromise leading to full CMS takeover, data theft, or server compromise if combined with other vulnerabilities.
Likely Case
Session hijacking, credential theft, or malicious actions performed with administrator privileges.
If Mitigated
Limited to client-side impact if proper CSP headers and input validation are in place.
🎯 Exploit Status
Exploit requires attacker to submit malicious contact form data; administrator must view the submission.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.3 or later
Vendor Advisory: https://github.com/GetSimpleCMS/GetSimpleCMS
Restart Required: No
Instructions:
1. Update plugin to version 1.1.3 or later via GetSimple CMS admin panel. 2. Verify update completes successfully. 3. Clear browser cache and test contact form functionality.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily disable My SMTP Contact Plugin until patched
Navigate to GetSimple CMS admin > Plugins > Deactivate 'My SMTP Contact Plugin'
Implement Content Security Policy
allAdd CSP headers to block inline script execution
Add to .htaccess: Header set Content-Security-Policy "default-src 'self'; script-src 'self'"
Or configure in web server settings
🧯 If You Can't Patch
- Restrict administrator access to trusted networks only
- Implement web application firewall rules to block XSS payloads
🔍 How to Verify
Check if Vulnerable:
Check plugin version in GetSimple CMS admin panel under Plugins > My SMTP Contact PluginCheck Version:
Check GetSimple CMS admin interface or plugin directory version.txt fileVerify Fix Applied:
Confirm plugin version is 1.1.3 or higher and test contact form with basic XSS payloads📡 Detection & Monitoring
Log Indicators:
- Unusual contact form submissions with hex-encoded characters
- Multiple failed login attempts from administrator accounts
Network Indicators:
- HTTP requests containing hex-encoded script tags in contact form data
SIEM Query:
source="web_logs" AND ("%3Cscript" OR "%26%23x" OR "contact-form") AND status=200