CVE-2014-8701
HighSummary
Wonder CMS 2014 allows remote attackers to obtain sensitive information by viewing /files/password, which reveals the unsalted MD5 hashed password.
Risk Assessment
Attackers can obtain user passwords, potentially leading to account takeover and access to sensitive data.
Recommendation
It is recommended to secure the /files/password file and implement stronger password hashing methods, such as bcrypt.
Other vulnerabilities in Wonder CMS 2014
See all- CVE-2023-41425Medium
A Cross-Site Scripting vulnerability in Wonder CMS versions 3.2.0 through 3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component.
- CVE-2014-8705Critical
Wonder CMS 2014 has a PHP remote file inclusion vulnerability in editInplace.php that allows remote attackers to execute arbitrary PHP code via a URL in the hook parameter.
- CVE-2014-8704Critical
Directory traversal vulnerability in index.php in Wonder CMS 2014 allows remote attackers to include and execute arbitrary local files via a crafted theme.
Original NVD description (English source)
Wonder CMS 2014 allows remote attackers to obtain sensitive information by viewing /files/password, which reveals the unsalted MD5 hashed password.