This vulnerability exists in the massiveAdmin plugin (v6.0.3) bundled with GetSimpleCMS-CE v3.3.22. The gsconfig editor module fails to include any cross-site request forgery protection. An attacker who can send a crafted request to the editor form can cause the server to write arbitrary PHP code into the gsconfig.php configuration file. Because a logged-in administrator’s session is used, the injected code executes with the web server’s account, giving the attacker full remote code execution capabilities. The weakness aligns with CWE-352, a cross-site request forgery flaw that enables privileged actions without authentication.

Affected systems are instances of GetSimple CMS Community Edition running version 3.3.22 that include the massiveAdmin plugin version 6.0.3. The plugin adds the vulnerable gsconfig editor functionality. Any deployment that has not applied a newer CMS release or removed the plugin is at risk.

The CVSS score is 9.7, indicating critical severity, while the EPSS score is less than 1%, suggesting that, at the time of scoring, the exploitation probability is very low but not zero. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the CSRF vector by convincing a logged-in administrator to visit a malicious URL that POSTs data to the editor endpoint, causing the server to write malicious PHP code to gsconfig.php. Once the file is processed by the web server, arbitrary code runs with the same privileges as the web process. Because the target is a logged-in administrator, the offset attack requires the victim to be authenticated, but the request can be triggered from an external site.