Description
WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution vulnerability that allows administrators to upload malicious modules. Attackers can craft a specially designed ZIP module with embedded PHP reverse shell code to gain remote system access when the module is installed.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
WBCE WBCE CMS
Default version status: unaffected
0 to ≤ 1.6.3affected
References
- https://www.exploit-db.com/exploits/52132 ↗
- https://wbce-cms.org/ ↗
- https://github.com/WBCE/WBCE_CMS ↗
- https://youtu.be/Dhg5gRe9Dzs?si=-WQoiWU1yqvYNz1e ↗
- https://github.com/Swammers8/WBCE-v1.6.3-Authenticated-RCE ↗
- https://www.vulncheck.com/advisories/wbce-cms-authenticated-remote-code-execution-via-module-upload ↗