CVE-2022-3992

CVE-2022-3992 Cross-Site Scripting in WonderCMS Description: A cross-site scripting XSS vulnerability in Sanitization Management System v1.0 allows potential attackers to upload arbitrary files via a crafted name into the system logo Fields of the System Info Fields. The cookie has no HttpOnly Fl...

CVE-2023-41425-RCE-WonderCMS-4.3.2

🚨 WonderCMS RCE Exploit Tool CVE-2023-41425 This Python-based offensive security tool automates the exploitation of a Remote Code Execution RCE vulnerability in WonderCMS 4.3.2 , specifically CVE-2023-41425. It streamlines the process of crafting a malicious ZIP theme module and delivering a...

CVE-2023-41425

RCE for WonderCMS versions v3.2.0 to v3.4.2 WonderCMS versions v3.2.0 to v3.4.2 with XSS vulnerability allow a malicious actor to achieve RCE by uploading a component to the installModule CVE-2023-41425 No need to know the password. Features: Automated exploitation of CVE-2023-41425 Ease of...

WonderCMS-4.3.2-XSS-to-RCE-Exploits-CVE-2023-41425

WonderCMS 4.3.2 XSS to RCE Exploits Overview These scripts exploit an XSS Cross-Site Scripting vulnerability in WonderCMS 4.3.2 to achieve Remote Code Execution RCE. The XSS payload, when triggered by the admin, automatically installs a reverse shell on the target server by leveraging a crafted...

WonderCMS-CVE-2020-35314

CVE-2020-35314 - Authenticated Remote Code Execution in WonderCMS 3.1.3 This repository was created with the goal of testing Remote Code Execution vulnerability on WonderCMS v3.1.3. This fake plugin includes a backdoor php shell, which is located in the file evil.php. It is recommended avoid usin...

wonderplugin

RCE용 Wonderplugin 프로덕션 웹 서버에서 이 가짜 플러그인을 사용하지 마십시오! 이 저장소는 wonderCMS의 취약점을 테스트하기 위한 목적으로 만들어졌습니다. 이 가짜 플러그인에는 백도어 웹 셸이 포함되어 있으며, evil.php 파일에서 확인할 수 있습니다. 관련 기사 WonderCMS 3.1.3 - 인증된 RCE 및 블라인드 SSRF 취약점 Exploit-DB WonderCMS 3.1.3 - 인증된 원격 코드 실행...

CVE-2023-41425-WonderCMS-Authenticated-RCE

CVE-2023-41425-WonderCMS-Authenticated-RCE 설명 WonderCMS v3.2.0 v3.4.2는 취약합니다. 원격 공격자는 XSSCross-Site Scripting 익스플로잇을 사용하여 서버를 완전히 장악할 수 있습니다교육 목적으로만 사용. 작동 방식은 다음과 같습니다: 작동 원리: 이 익스플로잇은 WonderCMS의 installModule 구성 요소를 악용하여 임의 코드를 실행하는 교묘한 스크립트를 몰래 주입합니다. 준비물 도구: exploit.py 필요한 것: WonderCMS가 설치된 대...

CVE-2025-57055

CVE-2025-57055: WonderCMS 3.5.0에서의 인증된 원격 코드 실행 취약점 작동 원리 인증된 원격 코드 실행RCE 취약점이 WonderCMS v3.5.0에 존재합니다. 문제는 애플리케이션이 JSON 설명자를 통해 원격 테마/모듈 설치 를 처리하는 방식에서 발생합니다. 관리자가 ZIP 아카이브를 참조하는 원격 JSON 파일을 제출하면, 해당 내용이 웹에서 접근 가능한 디렉토리예: /themes/에 추출됩니다. ZIP에 PHP 파일이 포함된 경우, 해당 파일은 웹을 통해 접근 가능해지며 실행될 수 있습니다. 이...

CVE-2022-43332

CVE-2022-43332 WonderCMS의 교차 사이트 스크립팅 설명: Wondercms v3.3.4의 교차 사이트 스크립팅XSS 취약점으로, 잠재적 공격자가 구성 패널Configuration Panel의 사이트 제목Site title 필드에 삽입된 조작된 페이로드를 통해 임의의 웹 스크립트나 HTML을 실행할 수 있습니다. 여기에 더해 쿠키에 HttpOnly 플래그가 없어 로그인한 사용자의 쿠키를 탈취하는 데 악용될 수 있습니다. 재현 방법: 재현하려면 wondercms.com에서 제공되는 zip 파일3.3.4을 다운로드...

poc-wondercms-360-xss

CVE — WonderCMS 3.6.0 Stored XSS via Search Widget Severity...

📄 WonderCMS 3.4.2 Shell Upload

Proof of concept exploit for an authentication shell upload vulnerability in WonderCMS version 3.4.2. ============================================================================================================================================= | Title : WonderCMS 3.4.2 Authenticated file upload...

CVE-2018-14387

An issue was discovered in WonderCMS before 2.5.2. An attacker can create a new session on a web application and record the associated session identifier. The attacker then causes the victim to authenticate against the server using the same session identifier. The attacker can access the user's...

CVE-2024-41305

A Server-Side Request Forgery SSRF in the Plugins Page of WonderCMS v3.4.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the pluginThemeUrl parameter...

CVE-2024-58305

WonderCMS 4.3.2 contains a cross-site scripting vulnerability that allows attackers to inject malicious JavaScript through the module installation endpoint. Attackers can craft a specially designed XSS payload to install a reverse shell module and execute remote commands by tricking an...

EUVD-2024-55351

WonderCMS 4.3.2 contains a cross-site scripting vulnerability that allows attackers to inject malicious JavaScript through the module installation endpoint. Attackers can craft a specially designed XSS payload to install a reverse shell module and execute remote commands by tricking an...

CVE-2024-58305

WonderCMS 4.3.2 contains a cross-site scripting vulnerability that allows attackers to inject malicious JavaScript through the module installation endpoint. Attackers can craft a specially designed XSS payload to install a reverse shell module and execute remote commands by tricking an...

CVE-2024-58305

WonderCMS 4.3.2 contains a cross-site scripting vulnerability that allows attackers to inject malicious JavaScript through the module installation endpoint. Attackers can craft a specially designed XSS payload to install a reverse shell module and execute remote commands by tricking an...

CVE-2024-58305 WonderCMS 4.3.2 Cross-Site Scripting Remote Code Execution via Module Installation

WonderCMS 4.3.2 contains a cross-site scripting vulnerability that allows attackers to inject malicious JavaScript through the module installation endpoint. Attackers can craft a specially designed XSS payload to install a reverse shell module and execute remote commands by tricking an...

CVE-2024-58305 WonderCMS 4.3.2 Cross-Site Scripting Remote Code Execution via Module Installation

WonderCMS 4.3.2 contains a cross-site scripting vulnerability that allows attackers to inject malicious JavaScript through the module installation endpoint. Attackers can craft a specially designed XSS payload to install a reverse shell module and execute remote commands by tricking an...

CVE-2024-58305

WonderCMS 4.3.2 has a cross-site scripting vulnerability at the module installation endpoint. An attacker can craft a payload to inject JavaScript and trick an authenticated administrator into visiting a malicious link, enabling installation of a reverse shell module and remote command execution....