Wolf CMS vulnerabilities

Wolf CMS before 0.8.3.1 allows unrestricted file rename and PHP Code Execution because the file manager does not prevent a change of a file extension to '.php' after originally using the parameter 'filename' for uploading a JPEG image. Exploitation requires a registered user who has access to upload functionality.

Wolf CMS versions before 0.8.3.1 allow unrestricted file upload and PHP Code Execution due to improper validation of the 'filename' parameter in the file manager module. Exploitation requires a registered user with upload access.

Wolf CMS through version 0.8.3.1 contains an authorization bypass vulnerability in BackupRestoreController due to a PHP operator precedence flaw in the permission check expression. Authenticated non-administrative users can exploit the incorrect evaluation of the access control expression to create, download, and restore backups without administrative privileges.

Wolf CMS through version 0.8.3.1 contains a remote code execution vulnerability in FileManagerController. Authenticated attackers can create arbitrary PHP files by exploiting missing file extension validation in the create_file() and save() functions. Attackers with the file_manager_mkfile capability can write malicious PHP content into the web-accessible FILES_DIR directory and trigger execution by requesting the file over HTTP.