Windu Cms
Monthly
Unrestricted file upload in Windu CMS version 4.1 enables authenticated low-privilege attackers to upload arbitrary PHP files and achieve remote code execution on the host server. The application performs no validation of uploaded file types, allowing a webshell to be placed and subsequently invoked via HTTP. No public exploit code has been identified at the time of analysis, and no KEV listing exists, but the attack path is trivial once credentials are obtained.
Windu CMS 4.1 stores user passwords using MD5 and SHA1 with a static salt, providing negligible resistance against offline cracking once password hashes are obtained. An attacker who acquires the credential database - through SQL injection, a backup exposure, or any secondary breach - can recover plaintext passwords rapidly using precomputed rainbow tables or GPU-accelerated cracking tools. No active exploitation has been confirmed (no CISA KEV listing, no public proof-of-concept), though the weakness is structurally severe: static salts eliminate the primary defense against precomputation attacks and MD5/SHA1 are high-throughput algorithms entirely unsuited to password storage.
Blind SQL injection in Windu CMS 4.1 lets remote attackers inject SQL syntax through the URL path carried in an HTTP header, requiring no authentication per the PR:N vector. Because the vendor (jcd) never responded to CERT-PL disclosure, only version 4.1 is confirmed vulnerable while other releases may also be affected. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the unauthenticated network-facing nature and CWE-89 root cause make it a high-severity data-exposure risk.
Windu CMS is vulnerable to multiple Stored Cross-Site Scripting (XSS) vulnerabilities in the page editing endpoint windu/admin/content/pages/edit/. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Windu CMS is vulnerable to User Enumeration. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Windu CMS is vulnerable to Stored Cross-Site Scripting (XSS) in the logon page where input data has no proper validation. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Windu CMS is vulnerable to Cross-Site Request Forgery in file uploading functionality. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Windu CMS implements weak client-side brute-force protection by using parameter loginError. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Windu CMS is vulnerable to Cross-Site Request Forgery in user editing functionality. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Windu CMS is vulnerable to Broken Access Control in user editing functionality. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Windu CMS is vulnerable to Cross-Site Request Forgery in user editing functionality. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unrestricted file upload in Windu CMS version 4.1 enables authenticated low-privilege attackers to upload arbitrary PHP files and achieve remote code execution on the host server. The application performs no validation of uploaded file types, allowing a webshell to be placed and subsequently invoked via HTTP. No public exploit code has been identified at the time of analysis, and no KEV listing exists, but the attack path is trivial once credentials are obtained.
Windu CMS 4.1 stores user passwords using MD5 and SHA1 with a static salt, providing negligible resistance against offline cracking once password hashes are obtained. An attacker who acquires the credential database - through SQL injection, a backup exposure, or any secondary breach - can recover plaintext passwords rapidly using precomputed rainbow tables or GPU-accelerated cracking tools. No active exploitation has been confirmed (no CISA KEV listing, no public proof-of-concept), though the weakness is structurally severe: static salts eliminate the primary defense against precomputation attacks and MD5/SHA1 are high-throughput algorithms entirely unsuited to password storage.
Blind SQL injection in Windu CMS 4.1 lets remote attackers inject SQL syntax through the URL path carried in an HTTP header, requiring no authentication per the PR:N vector. Because the vendor (jcd) never responded to CERT-PL disclosure, only version 4.1 is confirmed vulnerable while other releases may also be affected. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the unauthenticated network-facing nature and CWE-89 root cause make it a high-severity data-exposure risk.
Windu CMS is vulnerable to multiple Stored Cross-Site Scripting (XSS) vulnerabilities in the page editing endpoint windu/admin/content/pages/edit/. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Windu CMS is vulnerable to User Enumeration. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Windu CMS is vulnerable to Stored Cross-Site Scripting (XSS) in the logon page where input data has no proper validation. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Windu CMS is vulnerable to Cross-Site Request Forgery in file uploading functionality. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Windu CMS implements weak client-side brute-force protection by using parameter loginError. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Windu CMS is vulnerable to Cross-Site Request Forgery in user editing functionality. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Windu CMS is vulnerable to Broken Access Control in user editing functionality. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Windu CMS is vulnerable to Cross-Site Request Forgery in user editing functionality. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.