CVE-2017-14521

published 2018-01-26

CVE-2017-14521: In WonderCMS 2.3.1, the upload functionality accepts random application extensions and leads to malicious File Upload.

Priority P2 61 high 8.8 CVSS 3.0

AV N AC L PR L UI N S U C H I H A H

EXPLOIT

In WonderCMS 2.3.1, the upload functionality accepts random application extensions and leads to malicious File Upload.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
wondercms	wondercms	—	—
wondercms	wondercms	—	—

Detection & IOCs extracted from sources · hover to see the quote

url http://localhost:8081/wondercms/files/shell.php?cmd=dir↗

path /wondercms/files/shell.php↗

filename shell.php↗

• → Monitor for file uploads to the /wondercms/files/ directory with executable extensions (e.g., .php), which should not be permitted by a properly configured whitelist. ↗
• → Detect HTTP POST requests to the WonderCMS upload endpoint containing $_FILES['uploadFile'] with a PHP or other executable file extension in the filename. ↗
• → Detect HTTP GET requests to files under /wondercms/files/ that include a ?cmd= query parameter, indicating webshell command execution attempts. ↗

• · The vulnerability exists specifically in WonderCMS version 2.3.1; the patch was applied at line 742 of the referenced commit. Ensure version identification before applying detection rules. ↗
• · The fix involves creating a whitelist of allowed file types. Deployments that have applied the patch at the referenced GitHub commit should no longer be vulnerable. ↗

CVSS provenance

nvd v3.0 8.8 HIGH CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434