WBCE CMS
CVE-2025-67504
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated reset trigger (AV:N/PR:N), but predicting rand() needs seed recovery/timing so AC:H; account/admin takeover yields C:H/I:H while availability impact is only indirect (A:N).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword() to create passwords using PHP's rand(). rand() is not cryptographically secure, which allows password sequences to be predicted or brute-forced. This can lead to user account compromise or privilege escalation if these passwords are used for new accounts or password resets. The vulnerability is fixed in version 1.6.5.
AnalysisAI
Predictable account password generation in WBCE CMS 1.6.4 and earlier lets unauthenticated remote attackers recover or brute-force passwords produced by the PHP rand()-backed GenerateRandomPassword() routine, which feeds the admin 'forgot password' reset flow and other server-side password creation paths, potentially yielding account takeover and privilege escalation. The reset endpoint is reachable without authentication (CVSS PR:N), but successful compromise depends on the attacker recovering the weak PRNG seed/state, on timing observation to narrow that seed, and on the generated password actually being the credential delivered to the target account; the independent assessment accordingly rates this CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N rather than the published 9.8 base score. Publicly available exploit code exists (GitHub security advisory GHSA-76gj-pmvx-jcc6), no CISA KEV listing is present, and EPSS is low at 0.52% (42nd percentile), with a vendor fix released in version 1.6.5.
Technical ContextAI
The root cause is insufficient entropy in credential generation, mapped to CWE-331 (Insufficient Entropy) and referenced against CWE-338 (Use of a Cryptographically Weak PRNG). WBCE CMS's GenerateRandomPassword() in wbce/framework/Accounts.php built passwords from PHP's rand() over a small index range (rand(0,70) inside a loop terminating at i<=10, i.e. roughly 10 characters), and the same weak construction was used in wbce/admin/login/forgot/index.php for the admin password-reset flow. PHP's rand() is not a cryptographically secure pseudo-random number generator: its output stream is deterministic and, once an attacker recovers or narrows the seed/state (for example by observing reset timing or requesting multiple resets), subsequent passwords become predictable and enumerable, especially given the short pre-patch minimum password length of 6. The upstream fix (commit 5d59fe021a5c6e469b1bf192b72ca652e54278f6) replaces rand() with random_int(), extends the generation loop from i<=10 to i<=12, and raises iPassMinLength from 6 to 12, moving the application onto PHP's CSPRNG. Affected deployments are captured by the wildcard CPE cpe:2.3:a:wbce:wbce_cms:*:*:*:*:*:*:*:* for versions up to and including 1.6.4.
RemediationAI
Upgrade to WBCE CMS 1.6.5, which replaces PHP rand() with random_int(), lengthens generated passwords, and raises the minimum password length to 12; the vendor fix is the upstream commit 5d59fe021a5c6e469b1bf192b72ca652e54278f6 and the release is at https://github.com/WBCE/WBCE_CMS/releases/tag/1.6.5, with the advisory at https://github.com/WBCE/WBCE_CMS/security/advisories/GHSA-76gj-pmvx-jcc6. If immediate upgrade is not possible, change the policy so account creation and password resets require an administrator- or user-supplied password rather than an automatically generated one, reset any passwords that may have been issued by the vulnerable routine (since they remain guessable until rotated), and rate-limit or restrict network access to the wbce/admin/login/forgot endpoint so an attacker cannot harvest and correlate multiple generated values; note that restricting that endpoint will degrade or disable self-service password recovery for legitimate administrators. Because exploitation hinges on predicting a rand()-derived value, any credential that was ever produced by GenerateRandomPassword(), including stale admin passwords set through the reset flow, should be treated as compromised and rotated after the upgrade.
SQL injection vulnerability in the miniform module in WBCE CMS v.1.6.0 allows remote unauthenticated attacker to execute
WBCE CMS v1.5.4 can implement getshell by modifying the upload file type. Rated critical severity (CVSS 9.8), this vulne
wbce_cms is vulnerable to Improper Neutralization of Special Elements used in an SQL Command. Rated critical severity (C
SQL injection in WBCE CMS 1.6.4 and earlier lets an authenticated user who already holds the 'modify users' permission e
Wbce Cms versions up to 1.5.2 is affected by unrestricted upload of file with dangerous type (CVSS 8.8).
Authenticated remote code execution in WBCE CMS 1.6.3 and earlier allows an attacker holding an administrator account to
A vulnerability in the component /templates/install.php of WBCE CMS v1.5.2 allows attackers to execute arbitrary code vi
A vulnerability in the component /languages/index.php of WBCE CMS v1.5.2 allows attackers to execute arbitrary code via
A vulnerability, which was classified as problematic, has been found in WBCE CMS. Rated high severity (CVSS 7.5), this v
An arbitrary file upload vulnerability in the /languages/install.php component of WBCE CMS v1.6.1 allows attackers to ex
WBCE CMS 1.5.3 has a command execution vulnerability via admin/languages/install.php. Rated high severity (CVSS 7.2), th
An arbitrary file upload vulnerability in the Server Settings module of WBCE CMS v1.5.4 allows attackers to execute arbi
Same weakness CWE-331 – Insufficient Entropy
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today