← back
CVE-2020-35314

CVE-2020-35314

EPSS 26.9%
A remote code execution vulnerability in the installUpdateThemePluginAction function in index.php in WonderCMS 3.1.3, allows remote attackers to upload a custom plugin which can contain arbitrary code and obtain a webshell via the theme/plugin installer.
Affected products
n/a · n/a
public PoCs found — 4
githubgithub.com/ybdegit2020/wonderplugin★ 0githubgithub.com/AkashLingayat/WonderCMS-CVE-2020-35314★ 0cve_referencepacketstormsecurity.com/files/160311/WonderCMS-3.1.3-Remote-Code-Execution.htmlunverifiedexploitdbwww.exploit-db.com/exploits/49155unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://github.com/robiso/wondercmshttps://packetstormsecurity.com/files/160311/WonderCMS-3.1.3-Remote-Code-Execution.htmlhttps://zetc0de.github.io/post/authenticated-rce-ssrf-wondercms/https://zetc0de.github.io/post/authenticated-rce-ssrf-wondercms/#authenticated-remote-code-execution