CMSimple 5.24 ships with Cross‑Site Request Forgery protection disabled by default, turning the csrfProtection() function into a no‑op on every administrative request and omitting the csrf_token field from admin forms. Because authentication relies solely on cookies and no token is required, an attacker who can cause a logged‑in administrator to visit a malicious page can forge a content‑save request containing arbitrary text. This text is stored verbatim in content/content.php and later executed on every page view via evaluate_cmsimple_scripting(), which calls PHP eval() on the stored marker. The result is persistent remote code execution on the web server for all visitors, including unauthenticated users.

The vulnerable product is the CMSimple content management system, version 5.24. No other products or versions are reported.

The knowledge of this flaw indicates a high‑impact condition with potential for complete server compromise. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, so the current exploitation probability is uncertain, but the presence of an active remote code execution vector makes the risk significant. The attack requires inducing a logged‑in administrator to load a malicious page, which can be achieved through social engineering or compromised external sites; once the forged request is sent, the stored code will execute on all subsequent page loads, giving the attacker persistent control.