CVE:CVE-2014-2245
CNNVD:CNNVD-201403-098
CMS Made Simple（CMSMS）是CMSMS团队开发的一套开源的内容管理系统（CMS），该系统支持基于角色的权限管理系统、基于向导的安装与更新机制、智能缓存机制等。News是其中的一个新闻模块。
CMSMS 1.11.9及之前版本中的News模块存在SQL注入漏洞，该漏洞源于admin/moduleinterface.php脚本没有充分过滤‘sortby’参数。远程攻击者可利用该漏洞以‘Modify News’权限执行任意SQL命令。
solution:Upgrade cmsmadesimple cms_made_simple to a higher version than 1.11.9,0.1,0.2,0.2.1,0.3,0.3.1,0.3.2,0.4,0.4.1,0.5,0.5.1,0.6,0.6.1,0.6.2,0.6.3,0.7,0.7.1,0.7.2,0.7.3,0.8,0.8.1,0.8.2,0.9,0.9.1,0.9.2,0.10,0.10.1,0.10.2,0.10.3,0.10.4,0.11,0.11.1,0.11.2,0.12,0.12.1,0.12.2,0.13,1.0,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5,1.0.6,1.1,1.1.1,1.1.2,1.1.3,1.1.3.1,1.1.4,1.10,1.10.1,1.10.2,1.10.3,1.11,1.11.1,1.11.2,1.11.2.1,1.11.3,1.11.4,1.11.5,1.11.6,1.11.7,1.11.8,and avoid the version (,1.11.9],0.1,0.2,0.2.1,0.3,0.3.1,0.3.2,0.4,0.4.1,0.5,0.5.1,0.6,0.6.1,0.6.2,0.6.3,0.7,0.7.1,0.7.2,0.7.3,0.8,0.8.1,0.8.2,0.9,0.9.1,0.9.2,0.10,0.10.1,0.10.2,0.10.3,0.10.4,0.11,0.11.1,0.11.2,0.12,0.12.1,0.12.2,0.13,1.0,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5,1.0.6,1.1,1.1.1,1.1.2,1.1.3,1.1.3.1,1.1.4,1.10,1.10.1,1.10.2,1.10.3,1.11,1.11.1,1.11.2,1.11.2.1,1.11.3,1.11.4,1.11.5,1.11.6,1.11.7,1.11.8