WBCE CMS is a content management system. In versions 1.6.4 and below, the user management module allows a low-privileged authenticated user with permissions to modify users to execute arbitrary SQL queries. This can be escalated to a full database compromise, data exfiltration, effectively bypassing all security controls. The vulnerability exists in the admin/users/save.php script, which handles updates to user profiles. The script improperly processes the groups[] parameter sent from the user edit form. This issue is fixed in version 1.6.5.
The vulnerability is located in the admin/users/save.php script, which handles user profile updates. The script improperly processes the groups[] parameter submitted from the user edit form — lack of proper input data sanitization allows injection of malicious SQL code. The attacker must have an account with permissions to modify users, however even low privileges are sufficient to conduct the attack. By manipulating the groups[] parameter, it is possible to execute arbitrary queries directly on the database engine.
An attacker can gain full control over the database — read, modify or delete data, as well as exfiltrate it, effectively bypassing all security control mechanisms of the CMS system.
WBCE CMS should be updated to version 1.6.5, in which the vulnerability has been fixed. The patch is available in the official project repository on GitHub.
WBCE CMS in versions 1.6.4 and earlier
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XWbce Cms
APPWbce< 1.6.5
Related vulnerabilities
WBCE CMS: słabe generowanie haseł umożliwia privilege escalation
SQL Injection w module miniform WBCE CMS umożliwiający RCE
WBCE CMS — nieograniczony upload plików umożliwiający RCE (getshell)
SQL Injection w WBCE CMS umożliwiający przejęcie kontroli nad bazą danych
WBCE CMS version 1.5.2 contains an authenticated remote code execution vulnerability that allows attackers to ...