WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword() to create passwords using PHP's rand(). rand() is not cryptographically secure, which allows password sequences to be predicted or brute-forced. This can lead to user account compromise or privilege escalation if these passwords are used for new accounts or password resets. The vulnerability is fixed in version 1.6.5.
The GenerateRandomPassword() function responsible for creating passwords when creating new accounts and resetting passwords relies on PHP rand(), which is not a cryptographically secure random number generator (CWE-338, CWE-331). Values returned by rand() are predictable if the seed is known or can be guessed through brute-force methods. An attacker who knows the approximate time of password generation can significantly narrow down the range of possible values and reproduce the generated password.
An attacker can take over the account of any user whose password was generated or reset by the vulnerable function, and then perform privilege escalation to administrator rights in the CMS.
Update WBCE CMS to version 1.6.5, where the vulnerability has been fixed. After updating, it is recommended to force password reset for accounts whose passwords were generated automatically by the vulnerable function.
WBCE CMS in versions 1.6.4 and all earlier versions.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NWbce Cms
APPWbce< 1.6.5
Related vulnerabilities
SQL Injection w WBCE CMS — nieautoryzowany dostęp do bazy danych
SQL Injection w module miniform WBCE CMS umożliwiający RCE
WBCE CMS — nieograniczony upload plików umożliwiający RCE (getshell)
SQL Injection w WBCE CMS umożliwiający przejęcie kontroli nad bazą danych
WBCE CMS version 1.5.2 contains an authenticated remote code execution vulnerability that allows attackers to ...