Description
WonderCMS 4.3.2 contains a cross-site scripting vulnerability that allows attackers to inject malicious JavaScript through the module installation endpoint. Attackers can craft a specially designed XSS payload to install a reverse shell module and execute remote commands by tricking an authenticated administrator into accessing a malicious link.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| wondercms | WonderCMS | 4.3.2 | — |
References
- ExploitDB-51805 exploit
- WonderCMS Github Repository product
- WonderCMS Homepage product
- VulnCheck Advisory: WonderCMS 4.3.2 Cross-Site Scripting Remote Code Execution via Module Installation third-party-advisory