Jcd
Monthly
Blind SQL injection in Windu CMS 4.1 lets remote attackers inject SQL syntax through the URL path carried in an HTTP header, requiring no authentication per the PR:N vector. Because the vendor (jcd) never responded to CERT-PL disclosure, only version 4.1 is confirmed vulnerable while other releases may also be affected. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the unauthenticated network-facing nature and CWE-89 root cause make it a high-severity data-exposure risk.
Unrestricted file upload in Windu CMS version 4.1 enables authenticated low-privilege attackers to upload arbitrary PHP files and achieve remote code execution on the host server. The application performs no validation of uploaded file types, allowing a webshell to be placed and subsequently invoked via HTTP. No public exploit code has been identified at the time of analysis, and no KEV listing exists, but the attack path is trivial once credentials are obtained.
Windu CMS 4.1 stores user passwords using MD5 and SHA1 with a static salt, providing negligible resistance against offline cracking once password hashes are obtained. An attacker who acquires the credential database - through SQL injection, a backup exposure, or any secondary breach - can recover plaintext passwords rapidly using precomputed rainbow tables or GPU-accelerated cracking tools. No active exploitation has been confirmed (no CISA KEV listing, no public proof-of-concept), though the weakness is structurally severe: static salts eliminate the primary defense against precomputation attacks and MD5/SHA1 are high-throughput algorithms entirely unsuited to password storage.
Blind SQL injection in Windu CMS 4.1 lets remote attackers inject SQL syntax through the URL path carried in an HTTP header, requiring no authentication per the PR:N vector. Because the vendor (jcd) never responded to CERT-PL disclosure, only version 4.1 is confirmed vulnerable while other releases may also be affected. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the unauthenticated network-facing nature and CWE-89 root cause make it a high-severity data-exposure risk.
Unrestricted file upload in Windu CMS version 4.1 enables authenticated low-privilege attackers to upload arbitrary PHP files and achieve remote code execution on the host server. The application performs no validation of uploaded file types, allowing a webshell to be placed and subsequently invoked via HTTP. No public exploit code has been identified at the time of analysis, and no KEV listing exists, but the attack path is trivial once credentials are obtained.
Windu CMS 4.1 stores user passwords using MD5 and SHA1 with a static salt, providing negligible resistance against offline cracking once password hashes are obtained. An attacker who acquires the credential database - through SQL injection, a backup exposure, or any secondary breach - can recover plaintext passwords rapidly using precomputed rainbow tables or GPU-accelerated cracking tools. No active exploitation has been confirmed (no CISA KEV listing, no public proof-of-concept), though the weakness is structurally severe: static salts eliminate the primary defense against precomputation attacks and MD5/SHA1 are high-throughput algorithms entirely unsuited to password storage.