CVE-2021-3817

published 2021-12-09

CVE-2021-3817: wbce_cms is vulnerable to Improper Neutralization of Special Elements used in an SQL Command

Priority P2 74 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

wbce_cms is vulnerable to Improper Neutralization of Special Elements used in an SQL Command

Affected

2 ranges

Vendor	Product	Version range	Fixed in
wbce	wbce_cms	< 1.5.2	1.5.2
wbce	wbce_wbce_cms	>= unspecified < 1.5.2	1.5.2

Detection & IOCs extracted from sources · hover to see the quote

url http://<target>/wbce/admin/login/forgot/index.php↗

path /wbce/admin/login/forgot/index.php↗

command email=%27/**/or/**/user_id=1/**/or/**/'admin%40<domain>&submit=justrandomvalue↗

• → Detect SQLi payload in the POST body of the password-reset endpoint: look for URL-encoded single quote followed by comment-based whitespace bypass tokens (/**/) and user_id=1 in the email parameter targeting /wbce/admin/login/forgot/index.php ↗
• → Monitor POST requests to /wbce/admin/login/forgot/index.php with a Content-Type of application/x-www-form-urlencoded containing %27 (URL-encoded single quote) in the email field as an indicator of SQL injection exploitation attempts ↗
• → The exploit abuses the forgot-password flow to recover plaintext admin credentials via SQLi; alert on any password-reset email triggered for user_id=1 (the administrator account) from an external or unexpected source ↗
• → Google Dork can be used to identify exposed WBCE CMS instances: search for intext: "Way Better Content Editing" ↗

• · The exploit targets WBCE CMS versions up to and including 1.5.1; versions beyond this may have patched the SQLi in the forgot-password endpoint ↗
• · The attacker must control a catch-all email domain to receive the plaintext password reset email sent by the vulnerable application; the exploit author used a Namecheap domain with catch-all redirect ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89