CVE-2021-47788
HighSummary
WebsiteBaker 2.13.0 contains an authenticated remote code execution vulnerability that allows users with language editing permissions to execute arbitrary code. Attackers can exploit the language installation endpoint by manipulating language installation parameters to achieve remote code execution on the server.
Risk Assessment
The risk includes the possibility of full server compromise by an authenticated user, leading to loss of confidentiality, integrity, and availability of data.
Recommendation
It is recommended to restrict language editing permissions to trusted administrators and apply available patches or upgrade to a newer version.
Other vulnerabilities in WebsiteBaker
See all- CVE-2014-9242High
CVE-2014-9242 is an SQL injection vulnerability in admin/pages/modify.php in WebsiteBaker 2.8.3 that allows remote attackers to execute arbitrary SQL commands via the page_id parameter.
- CVE-2017-9771Critical
The install/save.php file in WebsiteBaker version 2.10.0 has a vulnerability that allows remote attackers to execute arbitrary PHP code via the database_username, database_host, or database_password parameters.
- CVE-2017-9360Critical
WebsiteBaker v2.10.0 has a SQL injection vulnerability in /account/details.php.
Original NVD description (English source)
WebsiteBaker 2.13.0 contains an authenticated remote code execution vulnerability that allows users with language editing permissions to execute arbitrary code. Attackers can exploit the language installation endpoint by manipulating language installation parameters to achieve remote code execution on the server.