Websitebaker Cms
Monthly
WebsiteBaker CMS before 2.13.10 exposes remote code execution through an unrestricted file upload flaw (CWE-434) in its module installation feature, allowing authenticated administrators to plant a PHP webshell that any unauthenticated internet user can subsequently trigger via direct HTTP request. The CVSS 4.0 vector scores 8.6 with PR:H, reflecting the administrator credential requirement, but the two-phase attack model means post-upload exploitation requires zero authentication. A public proof-of-concept has been published on Medium; the vulnerability is not currently listed in the CISA KEV catalog.
Code injection in WebsiteBaker CMS before 2.13.10 allows an authenticated administrator to plant a PHP webshell that is subsequently exploitable by unauthenticated remote attackers. The Droplets editor's save_droplet handler writes the Code field verbatim - without any content sanitization - to a publicly accessible PHP file inside the modules directory. Once an admin submits malicious PHP, any unauthenticated user can trigger full remote code execution by issuing a direct HTTP request to the predictable file path. A public proof-of-concept exploit exists; no CISA KEV listing at time of analysis.
WebsiteBaker CMS before 2.13.10 exposes remote code execution through an unrestricted file upload flaw (CWE-434) in its module installation feature, allowing authenticated administrators to plant a PHP webshell that any unauthenticated internet user can subsequently trigger via direct HTTP request. The CVSS 4.0 vector scores 8.6 with PR:H, reflecting the administrator credential requirement, but the two-phase attack model means post-upload exploitation requires zero authentication. A public proof-of-concept has been published on Medium; the vulnerability is not currently listed in the CISA KEV catalog.
Code injection in WebsiteBaker CMS before 2.13.10 allows an authenticated administrator to plant a PHP webshell that is subsequently exploitable by unauthenticated remote attackers. The Droplets editor's save_droplet handler writes the Code field verbatim - without any content sanitization - to a publicly accessible PHP file inside the modules directory. Once an admin submits malicious PHP, any unauthenticated user can trigger full remote code execution by issuing a direct HTTP request to the predictable file path. A public proof-of-concept exploit exists; no CISA KEV listing at time of analysis.