CVE-2021-47734 - CVE House
Back to Database
Status published High CVE-2021-47734

CMSimple 5.4 Authenticated Local File Inclusion Remote Code Execution

Vulnerability Description

CMSimple 5.4 contains an authenticated local file inclusion vulnerability that allows remote attackers to manipulate PHP session files and execute arbitrary code. Attackers can leverage the vulnerability by changing the functions file path and uploading malicious PHP code through session file upload mechanisms.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-47734

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • S1lv3r

References

More from Cmsimple

View All →
CVE-2021-47735
CMSimple 5.4 Authenticated Remote Code Execution via Template Editing
High 8.6
CVE-2021-47733
CMSimple 5.4 Cross-Site Scripting via HTML Unicode Encoding
Medium 5.1

Affected Vendor

Affected Software

CMSimple
Vulnerable Versions:
CMSimple 5.4

Timeline

Official Publish: December 23rd, 2025
Last Modified: March 17th, 2026
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-98

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1505 Server Software Component
Persistence
T1105 Ingress Tool Transfer
Command and Control
T1005 Data from Local System
Collection