CVE-2023-41425-wonderCMS_RCE

CVE-2023-41425-wonderCMSRCE Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component. For educational purposes only Requires knowledge of loginURL, admin access or the...

CVE-2023-50564

CVE-2023-50564 📌 Description This exploit allows an authenticated admin in Pluck CMS v4.7.18 to upload a malicious ZIP module containing a PHP shell, resulting in remote code execution RCE. ⚙️ Features Authenticates to the target using a valid username and password Automatically creates a ZIP...

CVE-2023-41425

Wonder CMS RCE | | Description : XSS to RCE, Wonder CMS 3.2.0 evil/evil.php EOF zip -r evil.zip evil/ JS payload that will install the new theme cat form+action=" EOF...

CVE-2023-41425

CVE-2023-41425 Description Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component. Working The attached exploit "exploit.py" performs the following actions: 1. It takes 3...

CVE-2023-41425

CVE-2023-41425 Description A Cross Site Scripting vulnerability in Wonder CMS Version 3.2.0 to Version 3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component. This is a modifed version of the original exploit by prodigiousMind which...

CVE-2023-41425

RCE for WonderCMS versions v3.2.0 to v3.4.2 WonderCMS versions v3.2.0 to v3.4.2 with XSS vulnerability allow a malicious actor to achieve RCE by uploading a component to the installModule CVE-2023-41425 No need to know the password. Features: Automated exploitation of CVE-2023-41425 Ease of...

CVE-2023-50564

CVE-2023-50564 - Pluck CMS v4.7.18 漏洞利用工具 概述 该脚本利用 Pluck CMS v4.7.18 中的已验证任意文件上传漏洞（CVE-2023-50564）。通过利用此漏洞，已通过身份验证的攻击者可以上传恶意 PHP 文件，从而执行任意代码（此处为反向 Shell）。 漏洞详情 CVE ID ：CVE-2023-50564 受影响版本 ：Pluck CMS v4.7.18 类型 ：已验证的任意文件上传 影响 ：远程代码执行（RCE） 该漏洞存在于 /admin.php?action=installmodule...

CVE-2023-41425-WonderCMS-Authenticated-RCE

CVE-2023-41425-WonderCMS-Authenticated-RCE 描述 WonderCMS v3.2.0 - v3.4.2 存在漏洞。远程攻击者可以通过跨站脚本（XSS）攻击完全控制服务器（仅供教育目的）。以下是攻击计划： 工作原理： 该漏洞利用 WonderCMS 的 installModule 组件，偷偷植入一个运行任意代码的恶意脚本。 设置 工具：exploit.py 必要条件： 安装了 WonderCMS 的目标 URL（无需管理员密码）。 攻击者机器的 IP 地址。 监听反向 Shell 的端口。 逐步执行 1. 脚本生成一个名为 xss.js 的文件。这个...

CVE-2023-41425

CVE-2023-41425 CVE-2023-41425 es una vulnerabilidad XSS reflejado en Wonder CMS que permite ejecutar código arbitrario a través de un script malicioso mediante el componente installModule. Uso Ejecutando el exploit contra la loginURL del objetivo, especificando nuestra IP y puerto para el servido...

CVE-2023-41425

Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component...

CVE-2023-26128

All versions of the package keep-module-latest are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employed to the installModule function. Note: To execute the code snippet and potentially exploit the vulnerability, the attacker needs to have...

Exploit for Cross-site Scripting in Wondercms

CVE-2023-41425-wonderCMSRCE Cross Site Scripting vulnerabilit...

The vulnerability of the installModule component in the Wonder CMS content management system allows attackers to perform cross-site scripting attacks.

The vulnerability of the installModule component in the Wonder CMS content management system is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...

CVE-2023-41425

Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component...

WonderCMS Security Breach

WonderCMS is an open source PHP-based content management system CMS. A security vulnerability exists in WonderCMS versions v.3.2.0 through v.3.4.2. An attacker can exploit this vulnerability to execute arbitrary code via specially crafted scripts uploaded to the installModule component...

CVE-2023-41425

Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component...

CVE-2023-41425

Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component...

CVE-2023-41425

Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component...

PT-2023-6828

Name of the Vulnerable Software and Affected Versions Wonder CMS versions 3.2.0 through 3.4.2 Description The issue is related to a Cross Site Scripting vulnerability that allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component. This...

Command Injection

keep-module-latest is vulnerable to command injection. The vulnerability exists in installModule function of index.js due to improper input sanitization, which allows an attacker to inject and execute malicious commands within the target environment...