critical9.8Public exploit code
CVE-2020-35314
A remote code execution vulnerability in the installUpdateThemePluginAction function in index.php in WonderCMS 3.1.3, allows remote attackers to upload a custo…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- WonderCMS 3.1.3 - Authenticated Remote Code Execution2020-12-02 · webapps · php
Impact
A remote code execution vulnerability in the installUpdateThemePluginAction function in index.php in WonderCMS 3.1.3, allows remote attackers to upload a custom plugin which can contain arbitrary code and obtain a webshell via the theme/plugin installer.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wondercms | Wondercms | Version 3.1.3 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/robiso/wondercms
- https://packetstormsecurity.com/files/160311/WonderCMS-3.1.3-Remote-Code-Execution.html
- https://zetc0de.github.io/post/authenticated-rce-ssrf-wondercms/
- https://zetc0de.github.io/post/authenticated-rce-ssrf-wondercms/#authenticated-remote-code-execution
- https://github.com/robiso/wondercms
- https://packetstormsecurity.com/files/160311/WonderCMS-3.1.3-Remote-Code-Execution.html
- https://zetc0de.github.io/post/authenticated-rce-ssrf-wondercms/
- https://zetc0de.github.io/post/authenticated-rce-ssrf-wondercms/#authenticated-remote-code-execution