CVE-2014-8705
CriticalSummary
Wonder CMS 2014 has a PHP remote file inclusion vulnerability in editInplace.php that allows remote attackers to execute arbitrary PHP code via a URL in the hook parameter.
Risk Assessment
Attackers can exploit this vulnerability to execute code remotely, potentially leading to system takeover or data leakage.
Recommendation
It is recommended to update Wonder CMS to the latest version and secure the application against malicious code injection.
Other vulnerabilities in Wonder CMS 2014
See all- CVE-2014-8701High
Wonder CMS 2014 allows remote attackers to obtain sensitive information by viewing /files/password, which reveals the unsalted MD5 hashed password.
- CVE-2023-41425Medium
A Cross-Site Scripting vulnerability in Wonder CMS versions 3.2.0 through 3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component.
- CVE-2014-8704Critical
Directory traversal vulnerability in index.php in Wonder CMS 2014 allows remote attackers to include and execute arbitrary local files via a crafted theme.
Original NVD description (English source)
PHP remote file inclusion vulnerability in editInplace.php in Wonder CMS 2014 allows remote attackers to execute arbitrary PHP code via a URL in the hook parameter.