CVE-2022-50936
HighSummary
WBCE CMS version 1.5.2 contains an authenticated remote code execution vulnerability. Authenticated attackers can upload malicious droplets via the admin panel, exploiting the droplet upload functionality to execute arbitrary PHP code through a crafted zip file.
Risk Assessment
The risk includes full server compromise, data theft, content manipulation, and further attacks on the infrastructure. However, authentication is required, so the risk mainly affects administrator accounts.
Recommendation
Immediately update WBCE CMS to the latest version that fixes this vulnerability. Additionally, restrict access to the admin panel and regularly audit administrator accounts.
Other vulnerabilities in WBCE CMS
See all- CVE-2017-2120High
CVE-2017-2120 describes an SQL injection vulnerability in WBCE CMS version 1.1.10 and earlier. It allows an attacker with administrator rights to execute arbitrary SQL commands via unspecified vectors.
- CVE-2017-2119High
Directory traversal vulnerability in WBCE CMS 1.1.10 and earlier allows remote attackers to read arbitrary files via unspecified vectors.
- CVE-2025-67504Critical
WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword() to create passwords using PHP's rand(). rand() is not cryptographically secure, which allows password sequences to be predicted or brute-forced. This can lead to user account compromise or privilege escalation if these passwords are used for new accounts or password resets. The vulnerability is fixed in version 1.6.5.
Original NVD description (English source)
WBCE CMS version 1.5.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious droplets through the admin panel. Authenticated attackers can exploit the droplet upload functionality in the admin tools to create and execute arbitrary PHP code by crafting a specially designed zip file payload.