CVE-2024-22715 – Stupid Simple CMS versions up to 1.2.4 contain ... (How to Fix)

Q: What is the severity of CVE-2024-22715?

CVE-2024-22715 has a CVSS score of 8.8 (HIGH). Stupid Simple CMS versions up to 1.2.4 contain a Cross-Site Request Forgery (CSRF) vulnerability in the admin-edit.php component. This allows attackers to trick authenticated administrators into performing unauthorized actions like content modification or account changes. Any organization using vulnerable versions of this CMS is affected.

📋 TL;DR

Stupid Simple CMS versions up to 1.2.4 contain a Cross-Site Request Forgery (CSRF) vulnerability in the admin-edit.php component. This allows attackers to trick authenticated administrators into performing unauthorized actions like content modification or account changes. Any organization using vulnerable versions of this CMS is affected.

💻 Affected Systems

Products:

Stupid Simple CMS

Versions: <= 1.2.4

Operating Systems: All

Default Config Vulnerable: ⚠️ Yes

Notes: Requires administrator authentication but no CSRF tokens by default.

📦 What is this software?

Stupid Simple Cms by Codelyfe

View all CVEs affecting Stupid Simple Cms →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete compromise of CMS content and administrative functions, including defacement, data manipulation, or privilege escalation.

🟠

Likely Case

Unauthorized content modification or configuration changes by tricking administrators into clicking malicious links.

🟢

If Mitigated

Limited impact with proper CSRF protections and admin awareness training.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires tricking authenticated admin users into visiting malicious pages.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: >1.2.4

Vendor Advisory: https://github.com/RumblingIsOccupied/cms/blob/main/1.md

Restart Required: No

Instructions:

1. Backup current installation. 2. Download latest version from official source. 3. Replace vulnerable files with patched version. 4. Verify admin-edit.php includes CSRF token validation.

🔧 Temporary Workarounds

Add CSRF Protection

all

Manually implement CSRF token validation in admin-edit.php

Edit admin-edit.php to include CSRF token generation and validation

Restrict Admin Access

all

Limit admin panel access to specific IP addresses

Add IP restriction rules to .htaccess or web server configuration

🧯 If You Can't Patch

Implement web application firewall with CSRF protection rules
Require re-authentication for sensitive admin actions

🔍 How to Verify

Check if Vulnerable:

Check CMS version in admin panel or readme file. If version <=1.2.4, examine admin-edit.php for CSRF token validation.

Check Version:

Check version.txt or admin panel footer

Verify Fix Applied:

Test admin-edit.php functionality with missing CSRF tokens - should reject requests.

📡 Detection & Monitoring

Log Indicators:

Multiple admin-edit.php requests without referrer headers
Admin actions from unexpected IP addresses

Network Indicators:

HTTP POST requests to admin-edit.php without CSRF tokens

SIEM Query:

source="web_logs" AND uri="/admin-edit.php" AND NOT csrf_token=*

📊 Metadata

CVE ID: CVE-2024-22715

CVSS v3 Score: 8.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE: CWE-352

Published: January 17, 2024

Last Updated: June 20, 2025

🔗 References

https://github.com/RumblingIsOccupied/cms/blob/main/1.md Exploit,Third Party Advisory
https://github.com/RumblingIsOccupied/cms/blob/main/1.md Exploit,Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-22715, you might also want to check these: