CyberRota Analysis
AI-GeneratedGetSimple CMS versions 3.4.0a and below, along with GetSimpleCMS-CE versions 3.3.22 and below, contain a critical logic flaw that permits unauthenticated attackers to create new administrator accounts due to a failure in the automated security control that deletes the sensitive `admin/setup.php` file. This vulnerability poses a severe risk, as it allows unauthorized access to the CMS, potentially leading to full system compromise. Organizations using these versions of GetSimple CMS should prioritize immediate remediation efforts, as there are currently no patched versions available.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. A logic flaw in GetSimple CMS (v3.4.0a and below) and GetSimpleCMS-CE (v3.3.22 and below) allows unauthenticated attackers to create a new administrator account. The application features an automated security control designed to delete the sensitive `admin/setup.php` file post-installation. However, this control is neutralized by a self-exclusion bug within the deletion logic, leaving the setup script accessible for unauthorized account creation even after a legitimate installation is completed. As of time of publication, no known patched versions are available.