CVE-2014-8704
CriticalSummary
Directory traversal vulnerability in index.php in Wonder CMS 2014 allows remote attackers to include and execute arbitrary local files via a crafted theme.
Risk Assessment
Attackers can exploit this vulnerability to execute malicious code on the server, potentially leading to system compromise and data loss.
Recommendation
It is recommended to update Wonder CMS to the latest version and review theme configurations to minimize the risk of this vulnerability being exploited.
Other vulnerabilities in Wonder CMS 2014
See all- CVE-2014-8701High
Wonder CMS 2014 allows remote attackers to obtain sensitive information by viewing /files/password, which reveals the unsalted MD5 hashed password.
- CVE-2023-41425Medium
A Cross-Site Scripting vulnerability in Wonder CMS versions 3.2.0 through 3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component.
- CVE-2014-8705Critical
Wonder CMS 2014 has a PHP remote file inclusion vulnerability in editInplace.php that allows remote attackers to execute arbitrary PHP code via a URL in the hook parameter.
Original NVD description (English source)
Directory traversal vulnerability in index.php in Wonder CMS 2014 allows remote attackers to include and execute arbitrary local files via a crafted theme.