Vulnerability Description
WBCE CMS version 1.6.2 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the Elfinder file manager. Attackers can exploit the file upload functionality in the elfinder connector to upload a web shell and execute arbitrary system commands through a user-controlled parameter.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Wbce | Wbce Cms | 1.6.2 |
Related Weaknesses (CWE)
References
- https://github.com/WBCE/WBCE_CMS/archive/refs/tags/1.6.2.zipProduct
- https://wbce-cms.org/Product
- https://www.exploit-db.com/exploits/52039Third Party AdvisoryVDB Entry
- https://www.vulncheck.com/advisories/wbce-cms-remote-code-execution-via-elfinderThird Party Advisory
- https://github.com/WBCE/WBCE_CMS/archive/refs/tags/1.6.2.zipProduct
FAQ
What is CVE-2024-58283?
CVE-2024-58283 is a vulnerability with a CVSS score of 8.8 (HIGH). WBCE CMS version 1.6.2 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the Elfinder file manager. Attackers can exploit the fil...
How severe is CVE-2024-58283?
CVE-2024-58283 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-58283?
Check the references section above for vendor advisories and patch information. Affected products include: Wbce Wbce Cms.