critical9.8Public exploit code
CVE-2020-35313
A server-side request forgery (SSRF) vulnerability in the addCustomThemePluginRepository function in index.php in WonderCMS 3.1.3 allows remote attackers to ex…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- WonderCMS 3.1.3 - Authenticated SSRF to Remote Remote Code Execution2020-12-02 · webapps · php
Impact
A server-side request forgery (SSRF) vulnerability in the addCustomThemePluginRepository function in index.php in WonderCMS 3.1.3 allows remote attackers to execute arbitrary code via a crafted URL to the theme/plugin installer.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wondercms | Wondercms | Version 3.1.3 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/robiso/wondercms
- https://packetstormsecurity.com/files/160310/WonderCMS-3.1.3-Code-Execution-Server-Side-Request-Forgery.html
- https://zetc0de.github.io/post/authenticated-rce-ssrf-wondercms/
- https://github.com/robiso/wondercms
- https://packetstormsecurity.com/files/160310/WonderCMS-3.1.3-Code-Execution-Server-Side-Request-Forgery.html
- https://zetc0de.github.io/post/authenticated-rce-ssrf-wondercms/