GetSimple CMS Unauthenticated RCE - CVE Deep Dive

You can find our full advisory here: https://ssd-disclosure.com/ssd-advisory-getcms-unauthenticated-remote-code-execution/ Keep up with the latest updates: https://ssd-disclosure.com/ https://twitter.com/SecuriTeam_SSD https://www.facebook.com/ssdsecuredisclosure SSD Secure Disclosure and PinkDraconian bring you a Deep Dive into some of the vulnerabilities reported to SSD through our vulnerability disclosure program. In this video, we discuss an old vulnerability in GetSimple CMS that allows unauthenticated attackers to perform remote code execution. Check out Robbe's channel: https://www.youtube.com/c/PinkDraconian 00:00 Introduction 00:18 What is GetSimple CMS? 00:42 Authenticated Remote Code Execution 02:00 Information disclosure 03:30 Crafting valid session tokens 04:50 Recap 05:30 Outro